{"record":{"id":"bd0cced42ebb8e51","repo":"peass-ng/PEASS-ng","slug":"corrupted-stream-out-of-bounds-length-found","errorCode":null,"errorMessage":"corrupted stream - out of bounds length found: ","messagePattern":"corrupted stream - out of bounds length found: ","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"winPEAS/winPEASexe/winPEAS/3rdParty/BouncyCastle/asn1/Asn1InputStream.cs","lineNumber":305,"sourceCode":"                if (size > 4)\n                    throw new IOException(\"DER length more than 4 bytes: \" + size);\n\n                length = 0;\n                for (int i = 0; i < size; i++)\n                {\n                    int next = s.ReadByte();\n\n                    if (next < 0)\n                        throw new EndOfStreamException(\"EOF found reading length\");\n\n                    length = (length << 8) + next;\n                }\n\n                if (length < 0)\n                    throw new IOException(\"corrupted stream - negative length found\");\n\n                if (length >= limit && !isParsing)   // after all we must have read at least 1 byte\n                    throw new IOException(\"corrupted stream - out of bounds length found: \" + length + \" >= \" + limit);\n            }\n\n            return length;\n        }\n\n        private static byte[] GetBuffer(DefiniteLengthInputStream defIn, byte[][] tmpBuffers)\n        {\n            int len = defIn.Remaining;\n            if (len >= tmpBuffers.Length)\n            {\n                return defIn.ToArray();\n            }\n\n            byte[] buf = tmpBuffers[len];\n            if (buf == null)\n            {\n                buf = tmpBuffers[len] = new byte[len];\n            }","sourceCodeStart":287,"sourceCodeEnd":323,"githubUrl":"https://github.com/peass-ng/PEASS-ng/blob/53fb989abc2219826385683a6fee826bd6cd38d6/winPEAS/winPEASexe/winPEAS/3rdParty/BouncyCastle/asn1/Asn1InputStream.cs#L287-L323","documentation":"ReadLength found a decoded length that is >= the stream's limit while the stream is not in parsing (indefinite) mode, meaning the object claims more bytes than the whole input contains. This guards against impossible/corrupt lengths.","triggerScenarios":"Declaring a length larger than the remaining input, e.g. a truncated file whose header claims a multi-KB body, or crafted input with a huge length value equal to or exceeding the buffer size passed to Asn1InputStream(data.Length).","commonSituations":"Partially written or truncated certificate stores; wrong slice of a larger blob passed to FromByteArray; limit set too small when constructing Asn1InputStream.","solutions":["Check that the byte slice passed in covers the complete ASN.1 object (re-extract with correct offsets)","Increase/verify the limit argument when constructing Asn1InputStream if the data is genuinely larger","Validate the source file is complete and untruncated (compare sizes/hashes)","Catch IOException and reject rather than retry parsing the same bytes"],"exampleFix":"// before\nbyte[] slice = new byte[100]; // hard-coded guess\nArray.Copy(blob, 0, slice, 0, 100);\nAsn1Object o = Asn1Object.FromByteArray(slice);\n// after\nAsn1Object o = Asn1Object.FromByteArray(blob); // parse the complete blob","handlingStrategy":"validation","validationCode":"static bool FitsInInput(byte[] data)\n{\n    if (data == null || data.Length < 2) return false;\n    int lb = data[1];\n    long declared = lb <= 0x7f ? lb : -1;\n    if (declared < 0)\n    {\n        int size = lb & 0x7f;\n        if (size < 1 || size > 4 || data.Length < 2 + size) return false;\n        declared = 0;\n        for (int i = 0; i < size; i++) declared = (declared << 8) | data[2 + i];\n    }\n    return declared < data.Length - 2;\n}","typeGuard":null,"tryCatchPattern":"try { Asn1Object o = Asn1Object.FromByteArray(slice); }\ncatch (IOException ex) when (ex.Message.Contains(\"out of bounds length\"))\n{\n    // slice too small or length field corrupt\n}","preventionTips":["Pass complete byte arrays, not hard-coded-size slices","Check truncation of source files before parsing","Set a correct limit when constructing Asn1InputStream for large inputs"],"tags":["asn1","der","length","bounds"],"backgroundTag":"der-length-out-of-bounds","analyzedSha":"53fb989abc2219826385683a6fee826bd6cd38d6","analyzedAt":"2026-09-02T04:25:09.259Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-09T11:17:12.671Z"}