{"record":{"id":"392687593af6df3f","repo":"peass-ng/PEASS-ng","slug":"attempt-to-get-non-octet-aligned-data-from-bit-str","errorCode":null,"errorMessage":"attempt to get non-octet aligned data from BIT STRING","messagePattern":"attempt to get non-octet aligned data from BIT STRING","errorType":"validation","errorClass":"InvalidOperationException","httpStatus":null,"severity":"error","filePath":"winPEAS/winPEASexe/winPEAS/3rdParty/BouncyCastle/asn1/DerBitString.cs","lineNumber":149,"sourceCode":"        }\n\n        public DerBitString(\n            Asn1Encodable obj)\n            : this(obj.GetDerEncoded())\n        {\n        }\n\n        /**\n         * Return the octets contained in this BIT STRING, checking that this BIT STRING really\n         * does represent an octet aligned string. Only use this method when the standard you are\n         * following dictates that the BIT STRING will be octet aligned.\n         *\n         * @return a copy of the octet aligned data.\n         */\n        public virtual byte[] GetOctets()\n        {\n            if (mPadBits != 0)\n                throw new InvalidOperationException(\"attempt to get non-octet aligned data from BIT STRING\");\n\n            return Arrays.Clone(mData);\n        }\n\n        public virtual byte[] GetBytes()\n        {\n            byte[] data = Arrays.Clone(mData);\n\n            // DER requires pad bits be zero\n            if (mPadBits > 0)\n            {\n                data[data.Length - 1] &= (byte)(0xFF << mPadBits);\n            }\n\n            return data;\n        }\n\n        public virtual int PadBits","sourceCodeStart":131,"sourceCodeEnd":167,"githubUrl":"https://github.com/peass-ng/PEASS-ng/blob/53fb989abc2219826385683a6fee826bd6cd38d6/winPEAS/winPEASexe/winPEAS/3rdParty/BouncyCastle/asn1/DerBitString.cs#L131-L167","documentation":"GetOctets() returns the raw octets of a BIT STRING and is only meaningful when the string is octet-aligned (no partial bits in the last byte). If mPadBits != 0 the last byte contains trailing padding bits, so returning the bytes would expose garbage; the method throws InvalidOperationException.","triggerScenarios":"Calling GetOctets() on a DerBitString parsed from a certificate (e.g. key usage, unique identifier, signature bits) whose stored padBits is nonzero — typically a bit string that is not a whole number of bytes.","commonSituations":"Reading X.509 extensions like KeyUsage or CRL distribution points that are encoded as BIT STRINGs with padding; assuming all BIT STRINGs from ASN.1 parsing are byte-aligned.","solutions":["Call GetBytes() instead — it returns the full content including padding bits.","Check the PadBits property; if nonzero, mask the last byte with (byte)(0xFF << padBits) or use GetBytes().","If you control the encoder, write octet-aligned data with padBits 0 so GetOctets() is valid."],"exampleFix":"// before\nbyte[] octets = bitString.GetOctets();\n// after\nbyte[] octets = bitString.PadBits == 0 ? bitString.GetOctets() : bitString.GetBytes();","handlingStrategy":"type-guard","validationCode":"if (bitString.PadBits != 0) { /* use GetBytes() or mask last byte */ }","typeGuard":"static bool IsOctetAligned(DerBitString bs) => bs.PadBits == 0;","tryCatchPattern":"try { octets = bs.GetOctets(); }\ncatch (InvalidOperationException) { octets = bs.GetBytes(); /* padded: use GetBytes */ }","preventionTips":["Default to GetBytes(); reserve GetOctets() for known-aligned strings","Check PadBits before calling GetOctets()","When generating BIT STRINGs, emit padBits 0 so GetOctets() stays valid"],"tags":["csharp","asn1","bit-string","bouncycastle","x509"],"backgroundTag":"non-octet-aligned-bitstring","analyzedSha":"53fb989abc2219826385683a6fee826bd6cd38d6","analyzedAt":"2026-09-02T04:25:09.259Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-09T11:17:12.671Z"}