{"record":{"id":"b56f687c4347f48e","repo":"peass-ng/PEASS-ng","slug":"unknown-object-encountered-in-constructed-octet-st","errorCode":null,"errorMessage":"unknown object encountered in constructed OCTET STRING: ","messagePattern":"unknown object encountered in constructed OCTET STRING: ","errorType":"exception","errorClass":"Asn1Exception","httpStatus":null,"severity":"error","filePath":"winPEAS/winPEASexe/winPEAS/3rdParty/BouncyCastle/asn1/Asn1InputStream.cs","lineNumber":112,"sourceCode":"            if (isConstructed)\n            {\n                // TODO There are other tags that may be constructed (e.g. BitString)\n                switch (tagNo)\n                {\n                    case Asn1Tags.OctetString:\n                        {\n                            //\n                            // yes, people actually do this...\n                            //\n                            Asn1EncodableVector v = ReadVector(defIn);\n                            Asn1OctetString[] strings = new Asn1OctetString[v.Count];\n\n                            for (int i = 0; i != strings.Length; i++)\n                            {\n                                Asn1Encodable asn1Obj = v[i];\n                                if (!(asn1Obj is Asn1OctetString))\n                                {\n                                    throw new Asn1Exception(\"unknown object encountered in constructed OCTET STRING: \"\n                                        + Platform.GetTypeName(asn1Obj));\n                                }\n\n                                strings[i] = (Asn1OctetString)asn1Obj;\n                            }\n\n                            return new BerOctetString(strings);\n                        }\n                    case Asn1Tags.Sequence:\n                        return CreateDerSequence(defIn);\n                    case Asn1Tags.Set:\n                        return CreateDerSet(defIn);\n                    case Asn1Tags.External:\n                        return new DerExternal(ReadVector(defIn));\n                    default:\n                        throw new IOException(\"unknown tag \" + tagNo + \" encountered\");\n                }\n            }","sourceCodeStart":94,"sourceCodeEnd":130,"githubUrl":"https://github.com/peass-ng/PEASS-ng/blob/53fb989abc2219826385683a6fee826bd6cd38d6/winPEAS/winPEASexe/winPEAS/3rdParty/BouncyCastle/asn1/Asn1InputStream.cs#L94-L130","documentation":"BouncyCastle's Asn1InputStream.BuildObject, while parsing a constructed OCTET STRING, requires every child element to itself be an Asn1OctetString (segments to concatenate). If any child is a different ASN.1 type, it throws Asn1Exception, meaning the BER data violates the expected structure of a constructed OCTET STRING.","triggerScenarios":"Parsing DER/BER bytes where a constructed (0x24/0x34 tagged) OCTET STRING contains nested elements of other types (SEQUENCE, UTF8String, INTEGER, etc.) instead of octet string segments — i.e. malformed or non-conformant ASN.1 data.","commonSituations":"Feeding hand-crafted or corrupt certificate/PKCS blobs to the parser; a data source that is not actually ASN.1 (HTML error page, truncated download); BER data produced by a non-compliant encoder mixing types inside constructed octet strings.","solutions":["Validate the input bytes are genuine, well-formed DER/BER ASN.1 before parsing (e.g. with a strict DER parser or openssl asn1parse).","Re-download or re-export the certificate/blob; the data is likely corrupt or truncated.","If the sender legitimately nests other types, fix the encoder — constructed OCTET STRING children must be octet string segments per X.690.","Catch Asn1Exception around ReadObject and handle malformed input gracefully."],"exampleFix":"// before\nAsn1Object obj = new Asn1InputStream(data).ReadObject();\n// after\ntry { Asn1Object obj = new Asn1InputStream(data).ReadObject(); }\ncatch (Asn1Exception ex) { throw new InvalidDataException(\"Malformed ASN.1 OCTET STRING\", ex); }","handlingStrategy":"validation","validationCode":"static bool LooksLikeAsn1OctetString(byte[] data)\n{\n    if (data == null || data.Length < 2) return false;\n    byte tag = data[0];\n    // constructed OCTET STRING tags are 0x24 or 0x34\n    if (tag != 0x24 && tag != 0x34) return false;\n    // second byte should be a plausible definite length for small blobs\n    return (data[1] & 0x80) == 0 || data.Length > 2;\n}","typeGuard":"static bool IsAsn1OctetString(Asn1Encodable o) => o is Asn1OctetString;","tryCatchPattern":"Asn1Object obj;\ntry {\n    obj = new Asn1InputStream(data).ReadObject();\n} catch (Asn1Exception ex) {\n    throw new InvalidDataException(\"Constructed OCTET STRING contains non-octet-string child: \" + ex.Message, ex);\n}","preventionTips":["Validate input with a strict DER linter (openssl asn1parse) before parsing","Never parse raw downloads that might be HTML error pages — check content type/headers","Re-export certificates from a trusted tool rather than hand-crafting ASN.1 bytes","Catch Asn1Exception at parse boundaries and report which input file failed"],"tags":["asn1","bouncycastle","parsing","der","ber"],"backgroundTag":"malformed-asn1-data","analyzedSha":"53fb989abc2219826385683a6fee826bd6cd38d6","analyzedAt":"2026-09-02T04:25:09.259Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-09T11:17:12.671Z"}