{"record":{"id":"937271646f945d33","repo":"peass-ng/PEASS-ng","slug":"corrupted-stream-invalid-high-tag-number-found-937271","errorCode":null,"errorMessage":"corrupted stream - invalid high tag number found","messagePattern":"corrupted stream - invalid high tag number found","errorType":"validation","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"winPEAS/winPEASexe/winPEAS/3rdParty/BouncyCastle/asn1/DerApplicationSpecific.cs","lineNumber":210,"sourceCode":"\t\t\treturn isConstructed.GetHashCode() ^ tag.GetHashCode() ^ Arrays.GetHashCode(octets);\n\t\t}\n\n\t\tprivate byte[] ReplaceTagNumber(\n\t\t\tint newTag,\n\t\t\tbyte[] input)\n\t\t{\n\t\t\tint tagNo = input[0] & 0x1f;\n\t\t\tint index = 1;\n\n\t\t\t// with tagged object tag number is bottom 5 bits, or stored at the start of the content\n\t\t\tif (tagNo == 0x1f)\n\t\t\t{\n\t\t\t\tint b = input[index++];\n\n\t\t\t\t// X.690-0207 8.1.2.4.2\n\t\t\t\t// \"c) bits 7 to 1 of the first subsequent octet shall not all be zero.\"\n\t\t\t\tif ((b & 0x7f) == 0) // Note: -1 will pass\n\t\t\t\t\tthrow new IOException(\"corrupted stream - invalid high tag number found\");\n\n\t\t\t\twhile ((b & 0x80) != 0)\n\t\t\t\t{\n\t\t\t\t\tb = input[index++];\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tint remaining = input.Length - index;\n\t\t\tbyte[] tmp = new byte[1 + remaining];\n\t\t\ttmp[0] = (byte)newTag;\n\t\t\tArray.Copy(input, index, tmp, 1, remaining);\n\t\t\treturn tmp;\n\t\t}\n\t}\n}\n","sourceCodeStart":192,"sourceCodeEnd":226,"githubUrl":"https://github.com/peass-ng/PEASS-ng/blob/53fb989abc2219826385683a6fee826bd6cd38d6/winPEAS/winPEASexe/winPEAS/3rdParty/BouncyCastle/asn1/DerApplicationSpecific.cs#L192-L226","documentation":"DerApplicationSpecific.ReplaceTagNumber scans the original header for a high-tag-number encoding; per X.690 8.1.2.4.2c, the first subsequent tag octet must not be zero, and if it is (or the header shape is inconsistent) it throws IOException 'corrupted stream - invalid high tag number found'. The input's high tag number encoding is malformed.","triggerScenarios":"GetObject/ReplaceTagNumber on an ApplicationSpecific object whose encoded header uses a high tag number form (first tag byte 0x1f) with a zero-valued following octet (e.g. 0x1f 0x00) or otherwise malformed multi-byte tag bytes.","commonSituations":"Hand-crafted or encoder-buggy ASN.1 with malformed high tag numbers; bit-corrupted data in transit; fuzzed/hostile input.","solutions":["Verify the source data is DER-compliant (first tag octet 0x1f requires nonzero subsequent tag bits)","Re-encode the object with a compliant encoder before processing","If the tag number is actually < 31, fix the encoder to use the low-tag form (no 0x1f prefix)","Catch IOException and reject as corrupt input"],"exampleFix":"// before\nvar o = DerApplicationSpecific.GetInstance(craftedBytes); // 0x1f 0x00... header\n// after\nif (craftedBytes[0] == 0x1f && craftedBytes[1] == 0x00)\n    throw new InvalidDataException(\"invalid high tag number (X.690 8.1.2.4.2c)\");\nvar o = DerApplicationSpecific.GetInstance(craftedBytes);","handlingStrategy":"validation","validationCode":"// X.690 8.1.2.4.2c: first subsequent tag octet must not be zero\nbool HasValidHighTag(byte[] d) { if (d.Length < 2 || (d[0] & 0x1f) != 0x1f) return true; return (d[1] & 0x7f) != 0; }","typeGuard":null,"tryCatchPattern":"try { var o = app.GetObject(tagNo); }\ncatch (IOException ex) { throw new InvalidDataException(\"malformed high tag number\", ex); }","preventionTips":["Encode low tag numbers (<31) without the 0x1f high-tag prefix","Validate DER conformance of input before processing","Reject crafted/fuzzed headers via a header pre-scan"],"tags":["asn1","high-tag-number","corrupt-data","bouncycastle"],"backgroundTag":"invalid-high-tag-number","analyzedSha":"53fb989abc2219826385683a6fee826bd6cd38d6","analyzedAt":"2026-09-02T04:25:09.259Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-09T11:17:12.671Z"}