{"record":{"id":"36e7a4ee952e4696","repo":"sqlmapproject/sqlmap","slug":"indefinite-length-der-is-not-permitted","errorCode":null,"errorMessage":"indefinite-length DER is not permitted","messagePattern":"indefinite-length DER is not permitted","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"extra/kerberos/der.py","lineNumber":106,"sourceCode":"\ndef sequenceOf(elements):\n    return _tlv(SEQUENCE, b\"\".join(bytes(_) for _ in elements))\n\n# ---- decoding -------------------------------------------------------------------------------------\ndef peel(data, offset=0):\n    \"\"\"Parse one TLV at 'offset'; return (tag, content_bytearray, next_offset). Raises ValueError on\n    truncated or indefinite-length input (the data may come from the network, so fail predictably).\"\"\"\n\n    data = bytearray(data)\n    if offset + 2 > len(data):\n        raise ValueError(\"truncated DER header\")\n    tag = data[offset]\n    first = data[offset + 1]\n    offset += 2\n    if first < 0x80:\n        length = first\n    elif first == 0x80:\n        raise ValueError(\"indefinite-length DER is not permitted\")\n    else:\n        count = first & 0x7f\n        if offset + count > len(data):\n            raise ValueError(\"truncated DER length\")\n        length = 0\n        for _ in range(count):\n            length = (length << 8) | data[offset]\n            offset += 1\n    if offset + length > len(data):\n        raise ValueError(\"truncated DER content\")\n    return tag, data[offset:offset + length], offset + length\n\ndef children(content):\n    \"\"\"Iterate the TLVs contained in a constructed value; yields (tag, content_bytearray).\"\"\"\n\n    content = bytearray(content)\n    offset = 0\n    out = []","sourceCodeStart":88,"sourceCodeEnd":124,"githubUrl":"https://github.com/sqlmapproject/sqlmap/blob/0a35b20e3953d341be6c7ac75ccb0b3362540c8d/extra/kerberos/der.py#L88-L124","documentation":"peel rejects DER with the indefinite-length form (first length byte 0x80). Kerberos on the wire uses DER, which mandates definite lengths; indefinite length (BER) would require end-of-contents scanning, so the decoder treats it as invalid input from a broken or malicious peer.","triggerScenarios":"Thrown at extra/kerberos/der.py:106 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Identify the sender producing BER-style indefinite lengths and fix its encoder to use definite lengths.","If data passed through a re-encoding proxy, disable or correct it.","Re-encode the blob with a DER-definite encoder before parsing.","Confirm the Kerberos library on the peer is configured for DER (asn1=DER)."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"0a35b20e3953d341be6c7ac75ccb0b3362540c8d","analyzedAt":"2026-08-26T23:02:52.002Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}