jstedfast/MailKit · error · ArgumentOutOfRangeException

count

Error message

count

What it means

ComputeHash(buffer, offset, count) throws ArgumentOutOfRangeException named "count" when count is negative or when offset + count exceeds the buffer (the check offset > buffer.Length - count). This guarantees the hashing region stays inside the array. It is thrown before HashCore runs, so the hash state is untouched.

Solutions

  1. Verify count is the number of bytes to hash and satisfies offset + count <= buffer.Length; fix the arithmetic.
  2. If the region is genuinely longer than the buffer, recompute the correct sub-range before calling.
  3. Validate inputs with (count >= 0 && offset <= buffer.Length - count) before invoking.
  4. If count comes from external data, validate/parse it upstream and fail with a clear message.

Example fix

// before
hasher.ComputeHash(buf, offset, len); // len could exceed buf.Length - offset
// after
int safeLen = Math.Min(len, buf.Length - offset);
hasher.ComputeHash(buf, offset, safeLen);
Defensive patterns

Strategy: validation

Validate before calling

if (count < 0 || offset > buffer.Length - count)
    throw new ArgumentOutOfRangeException(nameof(count), $"offset={offset}, count={count}, len={buffer.Length}");

Type guard

static bool IsValidCount(byte[] buffer, int offset, int count) =>
    count >= 0 && offset <= buffer.Length - count;

Try / catch

try { hash = md4.ComputeHash(data, offset, count); }
catch (ArgumentOutOfRangeException ex) when (ex.ParamName == "count") { log.LogError(ex, "count exceeds buffer"); throw; }

Prevention

When it happens

Trigger: Calling ComputeHash(buffer, offset, count) with count < 0, or with offset > buffer.Length - count (e.g. ComputeHash(data, data.Length - 2, 5) on a 10-byte array, or count passed as -1 from a failed length calculation).

Common situations: Mixing up byte counts with character counts when hashing a string's encoding; passing the wrong variable as count (offset instead of length); reading a 16-bit or 32-bit length prefix that was malformed.

Related errors


AI-assisted analysis of jstedfast/MailKit@9d3859a785 (2026-09-15). Data as JSON: /api/errors/b52e24eb3e276117. Report an issue: GitHub.

Appendix: source

Thrown at MailKit/Security/Ntlm/MD4.cs:296

			HH (ref c, d, a, b, x[ 7], S33); /* 47 */
			HH (ref b, c, d, a, x[15], S34); /* 48 */

			state [0] += a;
			state [1] += b;
			state [2] += c;
			state [3] += d;
		}

		public byte[] ComputeHash (byte[] buffer, int offset, int count)
		{
			if (buffer == null)
				throw new ArgumentNullException (nameof (buffer));

			if (offset < 0 || offset > buffer.Length)
				throw new ArgumentOutOfRangeException (nameof (offset));

			if (count < 0 || offset > buffer.Length - count)
				throw new ArgumentOutOfRangeException (nameof (count));

			if (disposed)
				throw new ObjectDisposedException (nameof (MD4));

			HashCore (buffer, offset, count);
			hashValue = HashFinal ();
			Initialize ();

			return hashValue;
		}

		public byte[] ComputeHash (byte[] buffer)
		{
			if (buffer == null)
				throw new ArgumentNullException (nameof (buffer));

			return ComputeHash (buffer, 0, buffer.Length);
		}

View on GitHub (pinned to 9d3859a785)