{"record":{"id":"c2ca003dcc6ff2ba","repo":"peass-ng/PEASS-ng","slug":"der-length-more-than-4-bytes","errorCode":null,"errorMessage":"DER length more than 4 bytes: ","messagePattern":"DER length more than 4 bytes: ","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"winPEAS/winPEASexe/winPEAS/3rdParty/BouncyCastle/asn1/Asn1InputStream.cs","lineNumber":288,"sourceCode":"            return tagNo;\n        }\n\n        internal static int ReadLength(Stream s, int limit, bool isParsing)\n        {\n            int length = s.ReadByte();\n            if (length < 0)\n                throw new EndOfStreamException(\"EOF found when length expected\");\n\n            if (length == 0x80)\n                return -1;      // indefinite-length encoding\n\n            if (length > 127)\n            {\n                int size = length & 0x7f;\n\n                // Note: The invalid long form \"0xff\" (see X.690 8.1.3.5c) will be caught here\n                if (size > 4)\n                    throw new IOException(\"DER length more than 4 bytes: \" + size);\n\n                length = 0;\n                for (int i = 0; i < size; i++)\n                {\n                    int next = s.ReadByte();\n\n                    if (next < 0)\n                        throw new EndOfStreamException(\"EOF found reading length\");\n\n                    length = (length << 8) + next;\n                }\n\n                if (length < 0)\n                    throw new IOException(\"corrupted stream - negative length found\");\n\n                if (length >= limit && !isParsing)   // after all we must have read at least 1 byte\n                    throw new IOException(\"corrupted stream - out of bounds length found: \" + length + \" >= \" + limit);\n            }","sourceCodeStart":270,"sourceCodeEnd":306,"githubUrl":"https://github.com/peass-ng/PEASS-ng/blob/53fb989abc2219826385683a6fee826bd6cd38d6/winPEAS/winPEASexe/winPEAS/3rdParty/BouncyCastle/asn1/Asn1InputStream.cs#L270-L306","documentation":"Asn1InputStream.ReadLength validates the long-form DER length field. X.690 allows at most 4 length bytes (max ~4GB), so when the low 7 bits of the first length byte indicate more than 4 following length octets, the stream is not valid DER and an IOException is thrown.","triggerScenarios":"Parsing a byte array or stream whose first length byte is 0x85-0xFF (long form with size > 4), typically because the data is not DER/BER encoded, is corrupted, or is being read at a wrong offset.","commonSituations":"Decrypting/parsing certificates, PFX, or signatures from corrupted files; feeding a PEM body without base64 decoding; misaligned stream offsets; truncated or maliciously crafted ASN.1 blobs.","solutions":["Verify the input is valid DER/BER and correctly base64-decoded before passing to Asn1InputStream","Check the offset/position where parsing begins; re-align to the actual start of the ASN.1 structure","Re-acquire the file/blob from a trusted source; the data is likely corrupted or truncated","If data may be untrusted, wrap ReadObject in try-catch and reject the input"],"exampleFix":"// before\nbyte[] raw = File.ReadAllBytes(pemPath); // still PEM text\nAsn1Object o = Asn1Object.FromByteArray(raw);\n// after\nstring b64 = ExtractBase64Body(File.ReadAllText(pemPath));\nbyte[] der = Convert.FromBase64String(b64);\nAsn1Object o = Asn1Object.FromByteArray(der);","handlingStrategy":"validation","validationCode":"static bool LooksLikeDerLength(byte[] data)\n{\n    if (data == null || data.Length < 2) return false;\n    int lenByte = data[1];\n    if (lenByte <= 0x7f) return true;                 // short form\n    int size = lenByte & 0x7f;                        // long form\n    return size >= 1 && size <= 4 && data.Length >= 2 + size;\n}","typeGuard":null,"tryCatchPattern":"try { Asn1Object o = Asn1Object.FromByteArray(data); }\ncatch (IOException ex) when (ex.Message.StartsWith(\"DER length\"))\n{\n    // input is not valid DER\n}","preventionTips":["Always base64-decode PEM bodies before ASN.1 parsing","Hex-inspect tag/length bytes when debugging parse failures","Treat externally supplied blobs as untrusted and pre-validate"],"tags":["asn1","der","parsing","bouncycastle"],"backgroundTag":"der-length-overflow","analyzedSha":"53fb989abc2219826385683a6fee826bd6cd38d6","analyzedAt":"2026-09-02T04:25:09.259Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-09T11:17:12.671Z"}