jstedfast/MailKit · error · ArgumentNullException

message

Error message

message

What it means

Guard in NtlmMessageBase.ValidateArguments, a shared validation helper called by NTLM message Encode/Decode paths: the 'message' byte array to encode into or decode from was null, so ArgumentNullException is thrown before the startIndex/length range checks.

Solutions

1. Read the raw server response bytes before constructing the message and null-check them.
2. Guard the network read: fail with a clear 'server did not send an NTLM challenge' error rather than passing null.
3. If the buffer may be absent, skip NTLM authentication instead of constructing the message.

Example fix

// before
var challenge = new NtlmChallengeMessage(challengeBytes, 0); // challengeBytes == null
// after
if (challengeBytes == null) throw new InvalidOperationException("Server did not provide an NTLM challenge.");
var challenge = new NtlmChallengeMessage(challengeBytes, 0);

if (rawMessage == null) throw new InvalidOperationException("No NTLM message bytes received from server.");
var msg = new NtlmChallengeMessage(rawMessage, 0);

static bool IsValidNtlmBuffer(byte[]? message) => message != null && message.Length >= 12;

try {
	msg = new NtlmChallengeMessage(rawMessage, 0);
} catch (ArgumentNullException ex) when (ex.ParamName == "message") {
	// the read produced no data; treat as missing server challenge
	throw new InvalidOperationException("Server did not send an NTLM challenge.", ex);
}

When it happens

Trigger: Calling a message constructor/decoder such as new NtlmNegotiateMessage(null) or NtlmChallengeMessage(null, 0) with a null buffer — usually because the server response was never read or a decode call returned null.

Common situations: Reading the server's Type2 response from a stream that returned nothing; storing the raw bytes in a field that was never initialized.

Related errors

• negotiate
• challenge
• userName
• password
• value

AI-assisted analysis of jstedfast/MailKit@9d3859a785 (2026-09-15). Data as JSON: /api/errors/1b84ccf299a24d92. Report an issue: GitHub.

Appendix: source

Thrown at MailKit/Security/Ntlm/NtlmMessageBase.cs:81

			message[11] = (byte)(Type >> 24);

			return message;
		}

		bool CheckSignature (byte[] message, int startIndex)
		{
			for (int i = 0; i < Signature.Length; i++) {
				if (message[startIndex + i] != Signature[i])
					return false;
			}

			return BitConverterLE.ToUInt32 (message, startIndex + 8) == Type;
		}

		protected void ValidateArguments (byte[] message, int startIndex, int length)
		{
			if (message == null)
				throw new ArgumentNullException (nameof (message));

			if (startIndex < 0 || startIndex > message.Length)
				throw new ArgumentOutOfRangeException (nameof (startIndex));

			if (length < 12 || length > (message.Length - startIndex))
				throw new ArgumentOutOfRangeException (nameof (length));

			if (!CheckSignature (message, startIndex))
				throw new ArgumentException (string.Format (CultureInfo.InvariantCulture, "Invalid Type{0} message.", Type), nameof (message));

			var messageType = BitConverterLE.ToUInt32 (message, 8);
			if (messageType != Type)
				throw new ArgumentException (string.Format (CultureInfo.InvariantCulture, "Invalid Type{0} message.", Type), nameof (message));
		}

		public abstract byte[] Encode ();
	}
}

View on GitHub (pinned to 9d3859a785)