{"record":{"id":"6ac751fdba626e9a","repo":"peass-ng/PEASS-ng","slug":"malformed-enumerated","errorCode":null,"errorMessage":"malformed enumerated","messagePattern":"malformed enumerated","errorType":"validation","errorClass":"ArgumentException","httpStatus":null,"severity":"error","filePath":"winPEAS/winPEASexe/winPEAS/3rdParty/BouncyCastle/asn1/DerEnumerated.cs","lineNumber":82,"sourceCode":"                throw new ArgumentException(\"enumerated must be non-negative\", \"val\");\n\n            this.bytes = BigInteger.ValueOf(val).ToByteArray();\n            this.start = 0;\n        }\n\n        public DerEnumerated(BigInteger val)\n        {\n            if (val.SignValue < 0)\n                throw new ArgumentException(\"enumerated must be non-negative\", \"val\");\n\n            this.bytes = val.ToByteArray();\n            this.start = 0;\n        }\n\n        public DerEnumerated(byte[] bytes)\n        {\n            if (DerInteger.IsMalformed(bytes))\n                throw new ArgumentException(\"malformed enumerated\", \"bytes\");\n            if (0 != (bytes[0] & 0x80))\n                throw new ArgumentException(\"enumerated must be non-negative\", \"bytes\");\n\n            this.bytes = Arrays.Clone(bytes);\n            this.start = DerInteger.SignBytesToSkip(bytes);\n        }\n\n        public BigInteger Value\n        {\n            get { return new BigInteger(bytes); }\n        }\n\n        public bool HasValue(BigInteger x)\n        {\n            return null != x\n                // Fast check to avoid allocation\n                && DerInteger.IntValue(bytes, start, DerInteger.SignExtSigned) == x.IntValue\n                && Value.Equals(x);","sourceCodeStart":64,"sourceCodeEnd":100,"githubUrl":"https://github.com/peass-ng/PEASS-ng/blob/53fb989abc2219826385683a6fee826bd6cd38d6/winPEAS/winPEASexe/winPEAS/3rdParty/BouncyCastle/asn1/DerEnumerated.cs#L64-L100","documentation":"DerEnumerated(byte[]) validates the bytes as a minimal, properly signed DER integer encoding via DerInteger.IsMalformed (leading zero bytes, empty arrays, overlong encodings). Bytes that do not conform to a valid integer content encoding throw 'malformed enumerated'.","triggerScenarios":"new DerEnumerated(bytes) where bytes is empty, contains redundant leading 0x00/0xFF octets, or is otherwise not a minimal two's-complement integer content, e.g. raw truncated DER content from a corrupted stream.","commonSituations":"Feeding raw TLV content that includes length/header bytes instead of just content octets; decoding records produced by buggy encoders that pad enumerated values.","solutions":["Pass only the content octets of the ENUMERATED TLV, not the whole record","Normalize the byte array (strip redundant leading octets) or take it from BigInteger.ToByteArray()","Verify with DerInteger.IsMalformed(bytes) before constructing","Catch ArgumentException and treat the source data as corrupt"],"exampleFix":"// before\nvar e = new DerEnumerated(rawTlvBytes);\n// after\nvar content = Asn1Object.FromByteArray(rawTlvBytes) as Asn1OctetString; // or correct TLV slice\nvar e = new DerEnumerated(content.GetOctets());","handlingStrategy":"validation","validationCode":"bool valid = bytes != null && bytes.Length > 0 && !DerInteger.IsMalformed(bytes);","typeGuard":null,"tryCatchPattern":"try { var e = new DerEnumerated(bytes); }\ncatch (ArgumentException) { /* quarantine corrupt record */ }","preventionTips":["Pass only content octets, never full TLVs","Use Arrays.Clone from trusted DER decode output","Run strict DER validation before construction","Test with padded/truncated encodings"],"tags":["asn1","bouncycastle","der","malformed"],"backgroundTag":"asn1-malformed-encoding","analyzedSha":"53fb989abc2219826385683a6fee826bd6cd38d6","analyzedAt":"2026-09-02T04:25:09.259Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-09T11:17:12.671Z"}