{"record":{"id":"1a0752bed87c6d3f","repo":"peass-ng/PEASS-ng","slug":"corrupted-stream-negative-length-found","errorCode":null,"errorMessage":"corrupted stream - negative length found","messagePattern":"corrupted stream - negative length found","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"winPEAS/winPEASexe/winPEAS/3rdParty/BouncyCastle/asn1/Asn1InputStream.cs","lineNumber":302,"sourceCode":"                int size = length & 0x7f;\n\n                // Note: The invalid long form \"0xff\" (see X.690 8.1.3.5c) will be caught here\n                if (size > 4)\n                    throw new IOException(\"DER length more than 4 bytes: \" + size);\n\n                length = 0;\n                for (int i = 0; i < size; i++)\n                {\n                    int next = s.ReadByte();\n\n                    if (next < 0)\n                        throw new EndOfStreamException(\"EOF found reading length\");\n\n                    length = (length << 8) + next;\n                }\n\n                if (length < 0)\n                    throw new IOException(\"corrupted stream - negative length found\");\n\n                if (length >= limit && !isParsing)   // after all we must have read at least 1 byte\n                    throw new IOException(\"corrupted stream - out of bounds length found: \" + length + \" >= \" + limit);\n            }\n\n            return length;\n        }\n\n        private static byte[] GetBuffer(DefiniteLengthInputStream defIn, byte[][] tmpBuffers)\n        {\n            int len = defIn.Remaining;\n            if (len >= tmpBuffers.Length)\n            {\n                return defIn.ToArray();\n            }\n\n            byte[] buf = tmpBuffers[len];\n            if (buf == null)","sourceCodeStart":284,"sourceCodeEnd":320,"githubUrl":"https://github.com/peass-ng/PEASS-ng/blob/53fb989abc2219826385683a6fee826bd6cd38d6/winPEAS/winPEASexe/winPEAS/3rdParty/BouncyCastle/asn1/Asn1InputStream.cs#L284-L320","documentation":"Thrown by ReadLength when decoding a DER long-form length: the first length byte indicates how many subsequent bytes encode the length, and that count exceeds 4 bytes, so the encoding is malformed or the stream is not valid DER at that position.","triggerScenarios":"A length field of 4 bytes whose high bit is set (e.g. 0x80 0x00 0x00 0x00 style values >= 2^31), producing an int overflow to a negative number during parsing of crafted or corrupt data.","commonSituations":"Malformed or maliciously crafted ASN.1 input (fuzzing/attacker-controlled blobs); byte-order or offset mistakes corrupting the length bytes; parsing non-DER binary that happens to start with a tag-like byte.","solutions":["Treat the input as corrupt; validate/verify its origin and integrity (hash, signature) before parsing","Pre-scan the first bytes: tag + length must follow X.690 encoding rules before invoking the parser","Use a parsing entry point with a bounded limit (Asn1InputStream with explicit limit) on untrusted data","Catch IOException around ReadObject/FromByteArray and reject the object"],"exampleFix":"// before\nAsn1Object o = Asn1Object.FromByteArray(untrustedBlob);\n// after\nif (untrustedBlob.Length < 2) throw new ArgumentException(\"too short\");\ntry { Asn1Object o = Asn1Object.FromByteArray(untrustedBlob); }\ncatch (IOException) { /* reject corrupt input */ }","handlingStrategy":"validation","validationCode":"static bool PlausibleAsn1Header(byte[] data)\n{\n    if (data == null || data.Length < 2) return false;\n    byte tag = data[0];\n    if ((tag & 0x1f) == 0x1f) return false; // high tag numbers unsupported here\n    byte lb = data[1];\n    if (lb <= 0x7f) return data.Length >= 2 + lb;\n    int size = lb & 0x7f;\n    if (size == 0 || size > 4 || data.Length < 2 + size) return false;\n    // reject lengths that overflow to negative int\n    return (data[2] & 0x80) == 0 || size < 4;\n}","typeGuard":null,"tryCatchPattern":"try { Asn1Object o = Asn1Object.FromByteArray(data); }\ncatch (IOException ex) when (ex.Message.Contains(\"negative length\") || ex.Message.Contains(\"out of bounds\"))\n{\n    // corrupt/hostile input: reject\n}","preventionTips":["Never parse untrusted blobs without a size limit (Asn1InputStream with explicit limit)","Validate input provenance (signature/hash) before parsing","Fuzz-test your parser entry points with malformed inputs"],"tags":["asn1","der","corrupt-data","parsing"],"backgroundTag":"asn1-corrupt-stream","analyzedSha":"53fb989abc2219826385683a6fee826bd6cd38d6","analyzedAt":"2026-09-02T04:25:09.259Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-09T11:17:12.671Z"}