{"record":{"id":"58cd333400260336","repo":"peass-ng/PEASS-ng","slug":"output-buffer-is-too-short-to-hold-output","errorCode":null,"errorMessage":"Output buffer is too short to hold output","messagePattern":"Output buffer is too short to hold output","errorType":"exception","errorClass":"DataLengthException","httpStatus":null,"severity":"error","filePath":"winPEAS/winPEASexe/winPEAS/3rdParty/BouncyCastle/crypto/digests/SkeinEngine.cs","lineNumber":744,"sourceCode":"\n        public void Update(byte inByte)\n        {\n            singleByte[0] = inByte;\n            Update(singleByte, 0, 1);\n        }\n\n        public void Update(byte[] inBytes, int inOff, int len)\n        {\n            CheckInitialised();\n            ubi.Update(inBytes, inOff, len, chain);\n        }\n\n        public int DoFinal(byte[] outBytes, int outOff)\n        {\n            CheckInitialised();\n            if (outBytes.Length < (outOff + outputSizeBytes))\n            {\n                throw new DataLengthException(\"Output buffer is too short to hold output\");\n            }\n\n            // Finalise message block\n            UbiFinal();\n\n            // Process additional post-message parameters\n            if (postMessageParameters != null)\n            {\n                for (int i = 0; i < postMessageParameters.Length; i++)\n                {\n                    Parameter param = postMessageParameters[i];\n                    UbiComplete(param.Type, param.Value);\n                }\n            }\n\n            // Perform the output transform\n            int blockSize = BlockSize;\n            int blocksRequired = ((outputSizeBytes + blockSize - 1) / blockSize);","sourceCodeStart":726,"sourceCodeEnd":762,"githubUrl":"https://github.com/peass-ng/PEASS-ng/blob/53fb989abc2219826385683a6fee826bd6cd38d6/winPEAS/winPEASexe/winPEAS/3rdParty/BouncyCastle/crypto/digests/SkeinEngine.cs#L726-L762","documentation":"Thrown by SkeinEngine's DoFinal when the caller-supplied output buffer is too small: outOff plus the configured output size in bytes exceeds outBytes.Length, so finishing the hash would write past the end of the buffer.","triggerScenarios":"Calling DoFinal(outBytes, outOff) where outBytes is shorter than outOff plus the digest size configured for the engine (e.g. a 32-byte buffer for a 64-byte Skein-512 output, or a large outOff).","commonSituations":"Assuming a SHA-256-sized 32-byte buffer when the Skein state was configured for a larger output size; off-by-one or reused outOff in incremental hashing loops.","solutions":["Allocate outBytes with at least outOff + engine output size bytes (GetDigestSize())","Reduce outOff or use a fresh buffer sized for the configured output","Lower the configured output size in the SkeinEngine constructor/SkeinParameters to match your buffer"],"exampleFix":"// before\nbyte[] outBytes = new byte[32];\nengine.DoFinal(outBytes, 0);\n// after\nbyte[] outBytes = new byte[engine.GetDigestSize()];\nengine.DoFinal(outBytes, 0);","handlingStrategy":"validation","validationCode":"byte[] outBytes = new byte[engine.GetDigestSize() + outOff];\nengine.DoFinal(outBytes, outOff);","typeGuard":"static bool CanHoldDigest(byte[] buf, int off, int digestSize) => buf != null && buf.Length >= off + digestSize;","tryCatchPattern":"try { engine.DoFinal(outBytes, outOff); } catch (DataLengthException ex) { /* grow buffer and retry */ }","preventionTips":["Size output buffers from GetDigestSize(), never hard-code 32","Reset outOff to 0 for single-shot hashing","Be aware Skein output size is configurable and may exceed SHA-256 sizes"],"tags":["csharp","cryptography","buffer-overflow"],"backgroundTag":"output-buffer-too-short","analyzedSha":"53fb989abc2219826385683a6fee826bd6cd38d6","analyzedAt":"2026-09-02T04:25:09.259Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-09T11:17:12.671Z"}