{"record":{"id":"e8307d25804ae672","repo":"peass-ng/PEASS-ng","slug":"truncated-bit-string-detected","errorCode":null,"errorMessage":"truncated BIT STRING detected","messagePattern":"truncated BIT STRING detected","errorType":"validation","errorClass":"ArgumentException","httpStatus":null,"severity":"error","filePath":"winPEAS/winPEASexe/winPEAS/3rdParty/BouncyCastle/asn1/DerBitString.cs","lineNumber":255,"sourceCode":"        {\n            StringBuilder buffer = new StringBuilder(\"#\");\n\n            byte[] str = GetDerEncoded();\n\n            for (int i = 0; i != str.Length; i++)\n            {\n                uint ubyte = str[i];\n                buffer.Append(table[(ubyte >> 4) & 0xf]);\n                buffer.Append(table[str[i] & 0xf]);\n            }\n\n            return buffer.ToString();\n        }\n\n        internal static DerBitString FromAsn1Octets(byte[] octets)\n        {\n            if (octets.Length < 1)\n                throw new ArgumentException(\"truncated BIT STRING detected\", \"octets\");\n\n            int padBits = octets[0];\n            byte[] data = Arrays.CopyOfRange(octets, 1, octets.Length);\n\n            if (padBits > 0 && padBits < 8 && data.Length > 0)\n            {\n                int last = data[data.Length - 1];\n                int mask = (1 << padBits) - 1;\n\n                if ((last & mask) != 0)\n                {\n                    return new BerBitString(data, padBits);\n                }\n            }\n\n            return new DerBitString(data, padBits);\n        }\n    }","sourceCodeStart":237,"sourceCodeEnd":273,"githubUrl":"https://github.com/peass-ng/PEASS-ng/blob/53fb989abc2219826385683a6fee826bd6cd38d6/winPEAS/winPEASexe/winPEAS/3rdParty/BouncyCastle/asn1/DerBitString.cs#L237-L273","documentation":"FromAsn1Octets (invoked via GetInstance) decodes the raw contents of a BIT STRING, where the first octet encodes the number of pad bits. An octet array shorter than 1 byte has no pad-count octet at all, so the encoding is truncated and ArgumentException is thrown.","triggerScenarios":"Calling DerBitString.GetInstance / FromAsn1Octets with an empty (zero-length) byte[] — e.g. an ASN.1 TLV whose content octets were mis-sliced or an empty BIT STRING read from a malformed certificate.","commonSituations":"Parsing corrupt or hand-crafted DER/PEM data; off-by-one slicing that drops the pad-count byte; certificate fields with zero-length BIT STRING contents.","solutions":["Validate that the octet array length is >= 1 before decoding.","Fix the upstream slicing/parsing that produced the empty array (check tag/length handling).","Treat the source data as corrupt — re-export or re-parse the certificate/structure with a validating parser."],"exampleFix":"// before\nvar bs = DerBitString.GetInstance(contentOctets);\n// after\nif (contentOctets == null || contentOctets.Length < 1)\n    throw new InvalidDataException(\"BIT STRING content missing pad-count octet\");\nvar bs = DerBitString.GetInstance(contentOctets);","handlingStrategy":"validation","validationCode":"if (octets == null || octets.Length < 1) throw new InvalidDataException(\"BIT STRING needs at least the pad-count octet\");","typeGuard":"static bool IsDecodableBitStringOctets(byte[] o) => o != null && o.Length >= 1;","tryCatchPattern":"try { var bs = DerBitString.GetInstance(octets); }\ncatch (ArgumentException) { /* truncated/corrupt DER: re-parse or reject input */ }","preventionTips":["Validate TLV lengths when hand-parsing DER before extracting content","Reject zero-length BIT STRING content at the parser boundary","Test parsing against corrupt/truncated certificate fixtures"],"tags":["csharp","asn1","der-parsing","bouncycastle","truncated-data"],"backgroundTag":"truncated-der-data","analyzedSha":"53fb989abc2219826385683a6fee826bd6cd38d6","analyzedAt":"2026-09-02T04:25:09.259Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-09T11:17:12.671Z"}