{"record":{"id":"295e2556429fa2ec","repo":"dotnet/wpf","slug":"sr-cryptoprovidercannotmergeblocks","errorCode":null,"errorMessage":"SR.CryptoProviderCanNotMergeBlocks","messagePattern":"SR\\.CryptoProviderCanNotMergeBlocks","errorType":"exception","errorClass":"ArgumentException","httpStatus":null,"severity":"error","filePath":"src/Microsoft.DotNet.Wpf/src/WindowsBase/MS/Internal/IO/Packaging/CompoundFile/RightsManagementEncryptedStream.cs","lineNumber":286,"sourceCode":"        //\n        //  Internal Methods\n        //\n        //------------------------------------------------------\n        internal RightsManagementEncryptedStream(\n                                        Stream baseStream,\n                                        CryptoProvider cryptoProvider)\n        {\n            Debug.Assert(baseStream != null);\n            Debug.Assert(cryptoProvider != null);\n\n            if (!cryptoProvider.CanDecrypt )\n            {\n                throw new ArgumentException(SR.CryptoProviderCanNotDecrypt, nameof(cryptoProvider));            \n            }\n\n            if (!cryptoProvider.CanMergeBlocks)\n            {\n                throw new ArgumentException(SR.CryptoProviderCanNotMergeBlocks, nameof(cryptoProvider));            \n            }\n            \n            _baseStream = baseStream;\n            _cryptoProvider = cryptoProvider;\n\n            // Currently BitConverter is implemented as only supporting Little Endian byte order    \n            // regardless of the machine type. We would like to make sure that this doesn't change \n            // as we need Little Endian byte order decoding capability on all machines in order to \n            // parse files that travel across different machine types.\n            Debug.Assert(BitConverter.IsLittleEndian);\n\n            // initialize stream length\n            ParseStreamLength();\n        }\n\n        //------------------------------------------------------\n        //\n        //  Private Methods","sourceCodeStart":268,"sourceCodeEnd":304,"githubUrl":"https://github.com/dotnet/wpf/blob/81131a70a4c573cd62748a5c36908fc4d662daa9/src/Microsoft.DotNet.Wpf/src/WindowsBase/MS/Internal/IO/Packaging/CompoundFile/RightsManagementEncryptedStream.cs#L268-L304","documentation":"The constructor also requires cryptoProvider.CanMergeBlocks to be true: this stream's decryption algorithm assumes the CryptoProvider can correctly handle block merging during transform. A provider that cannot merge blocks cannot satisfy the block-size invariants this stream implementation relies on, so ArgumentException (SR.CryptoProviderCanNotMergeBlocks) is thrown for the cryptoProvider parameter.","triggerScenarios":"Constructing RightsManagementEncryptedStream(baseStream, cryptoProvider) where cryptoProvider.CanMergeBlocks == false — i.e. the provider's block granularity is incompatible with the encrypted stream's block layout.","commonSituations":"Using a CryptoProvider obtained from a rights-management implementation whose content key/block size differs from what the packaging layer expects; mixing crypto providers across implementations or versions where block-merge support is absent.","solutions":["Check cryptoProvider.CanMergeBlocks before construction and choose an alternate provider that supports block merging.","Re-acquire the use license / CryptoProvider from the same rights-management implementation that published the content so block sizes match.","Update the RM SDK/environment to a version whose providers support CanMergeBlocks for this content.","Do not attempt to work around by wrapping the provider; the invariant is required by the stream's block math."],"exampleFix":"// before\nvar stream = new RightsManagementEncryptedStream(baseStream, cryptoProvider);\n// after\nif (!cryptoProvider.CanMergeBlocks)\n    throw new InvalidOperationException(\"CryptoProvider cannot merge blocks; incompatible provider.\");\nvar stream = new RightsManagementEncryptedStream(baseStream, cryptoProvider);","handlingStrategy":"validation","validationCode":"if (cryptoProvider == null)\n    throw new ArgumentNullException(nameof(cryptoProvider));\nif (!cryptoProvider.CanMergeBlocks)\n    throw new InvalidOperationException(\"CryptoProvider lacks block-merge support.\");\nvar stream = new RightsManagementEncryptedStream(baseStream, cryptoProvider);","typeGuard":"bool CanUseForEncryptedStream(System.Security.RightsManagement.CryptoProvider p)\n    => p != null && p.CanDecrypt && p.CanMergeBlocks;","tryCatchPattern":"try { stream = new RightsManagementEncryptedStream(baseStream, cryptoProvider); }\ncatch (ArgumentException ex) when (ex.ParamName == \"cryptoProvider\")\n{ /* swap to a merge-capable provider or report incompatibility */ }","preventionTips":["Gate construction on CanDecrypt && CanMergeBlocks in a single guard.","Acquire CryptoProvider from the same RM implementation/SDK that published the content.","Avoid mixing providers across RM SDK versions.","Fail fast with a clear message instead of attempting block-level workarounds."],"tags":["rights-management","crypto","argumentexception","incompatible-provider"],"backgroundTag":"incompatible-source-type","analyzedSha":"81131a70a4c573cd62748a5c36908fc4d662daa9","analyzedAt":"2026-09-14T10:12:48.479Z","contentChangedAt":"2026-09-14T10:12:48.479Z","schemaVersion":2},"datasetVersion":"2026-09-21T21:30:21.729Z"}