{"record":{"id":"882d6c1433be3688","repo":"peass-ng/PEASS-ng","slug":"der-length-more-than-4-bytes-882d6c","errorCode":null,"errorMessage":"DER length more than 4 bytes: ","messagePattern":"DER length more than 4 bytes: ","errorType":"validation","errorClass":"InvalidOperationException","httpStatus":null,"severity":"error","filePath":"winPEAS/winPEASexe/winPEAS/3rdParty/BouncyCastle/asn1/DerApplicationSpecific.cs","lineNumber":106,"sourceCode":"\n\t\tprivate int GetLengthOfHeader(\n\t\t\tbyte[] data)\n\t\t{\n\t\t\tint length = data[1]; // TODO: assumes 1 byte tag\n\n\t\t\tif (length == 0x80)\n\t\t\t{\n\t\t\t\treturn 2;      // indefinite-length encoding\n\t\t\t}\n\n\t\t\tif (length > 127)\n\t\t\t{\n\t\t\t\tint size = length & 0x7f;\n\n\t\t\t\t// Note: The invalid long form \"0xff\" (see X.690 8.1.3.5c) will be caught here\n\t\t\t\tif (size > 4)\n\t\t\t\t{\n\t\t\t\t\tthrow new InvalidOperationException(\"DER length more than 4 bytes: \" + size);\n\t\t\t\t}\n\n\t\t\t\treturn size + 2;\n\t\t\t}\n\n\t\t\treturn 2;\n\t\t}\n\n\t\tpublic bool IsConstructed()\n\t\t{\n\t\t\treturn isConstructed;\n\t\t}\n\n\t\tpublic byte[] GetContents()\n\t\t{\n\t\t\treturn octets;\n\t\t}\n","sourceCodeStart":88,"sourceCodeEnd":124,"githubUrl":"https://github.com/peass-ng/PEASS-ng/blob/53fb989abc2219826385683a6fee826bd6cd38d6/winPEAS/winPEASexe/winPEAS/3rdParty/BouncyCastle/asn1/DerApplicationSpecific.cs#L88-L124","documentation":"DerApplicationSpecific.GetLengthOfHeader parses the DER length-of-length field; if the long-form size indicator exceeds 4 bytes (invalid per X.690, including the forbidden 0xFF form) it throws InvalidOperationException 'DER length more than 4 bytes'. Lengths requiring more than 4 octets are not supported here.","triggerScenarios":"Parsing an ApplicationSpecific object whose header contains a long-form length with >4 subsequent length octets, or the invalid 0xFF length-of-length byte — corrupt or non-conformant DER input.","commonSituations":"Processing BER data encoded by non-conformant encoders; corrupted/crafted input with absurd length fields; accidentally parsing raw payload bytes as an ASN.1 header.","solutions":["Validate/normalize input to proper DER (e.g. re-encode via BouncyCastle after successful parse) before it reaches this path","Reject input whose header bytes look non-DER (0x80|0xFF length-of-length) in a pre-scan","Regenerate the data with a compliant encoder if it came from an in-house tool","Catch InvalidOperationException and treat the blob as corrupt/untrusted"],"exampleFix":"// before\nvar app = DerApplicationSpecific.GetInstance(untrustedBytes);\n// after\nif (untrustedBytes.Length > 1 && (untrustedBytes[0] & 0x1f) == 0x1f && untrustedBytes[1] > 0x84)\n    throw new InvalidDataException(\"unsupported/non-DER length header\");\nvar app = DerApplicationSpecific.GetInstance(untrustedBytes);","handlingStrategy":"validation","validationCode":"// reject non-DER long-form length headers (>4 length octets)\nbool HasConformantLength(byte[] d) { if (d.Length < 2 || (d[1] & 0x80) == 0) return true; int n = d[1] & 0x7f; return n > 0 && n <= 4; }","typeGuard":null,"tryCatchPattern":"try { return DerApplicationSpecific.GetInstance(bytes); }\ncatch (InvalidOperationException ex) { throw new InvalidDataException(\"non-DER length header\", ex); }","preventionTips":["Enforce DER (not BER) at ingestion: normalize/re-encode after successful parse","Sanity-check length-of-length bytes on untrusted input","Regenerate blobs produced by non-conformant in-house encoders"],"tags":["asn1","der-length","corrupt-data","bouncycastle"],"backgroundTag":"der-length-out-of-bounds","analyzedSha":"53fb989abc2219826385683a6fee826bd6cd38d6","analyzedAt":"2026-09-02T04:25:09.259Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-09T11:17:12.671Z"}