jstedfast/MailKit · error · ArgumentOutOfRangeException

startIndex

Error message

startIndex

What it means

NtlmMessageBase.ValidateArguments throws ArgumentOutOfRangeException when startIndex is negative or greater than message.Length. It bounds-checks the offset into the raw NTLM message before reading the signature and type fields.

Solutions

1. Use startIndex 0 for a standalone NTLM message, or compute the offset from the actual SPNEGO header length.
2. Clamp/verify: 0 <= startIndex && startIndex <= message.Length before calling.
3. Prefer the constructor overloads without an explicit startIndex when the message starts at byte 0.

Example fix

// before
var challenge = new NtlmChallengeMessage(buffer, 12); // buffer.Length is 8
// after
int start = Math.Min(12, buffer.Length);
var challenge = new NtlmChallengeMessage(buffer, start >= 0 ? start : 0); // or just use 0 for a raw Type2

if (startIndex < 0 || startIndex > message.Length) throw new ArgumentOutOfRangeException(nameof(startIndex));
var msg = new NtlmChallengeMessage(message, startIndex);

static bool IsValidStartIndex(byte[] message, int startIndex) =>
	message != null && startIndex >= 0 && startIndex <= message.Length;

try {
	msg = new NtlmChallengeMessage(buffer, startIndex);
} catch (ArgumentOutOfRangeException ex) when (ex.ParamName == "startIndex") {
	// bad SPNEGO offset; retry from the start of the buffer
	startIndex = 0;
	msg = new NtlmChallengeMessage(buffer, startIndex);
}

When it happens

Trigger: Passing a startIndex outside [0, message.Length] — e.g. a hardcoded nonzero offset on a short buffer, or an offset advanced past the response length after parsing a concatenated stream.

Common situations: Parsing SPNEGO-wrapped NTLM messages where the inner-message offset was computed wrongly; reusing an offset from a previous larger message.

Related errors

• message
• ArgumentOutOfRangeException
• buffer
• challenge
• count

AI-assisted analysis of jstedfast/MailKit@9d3859a785 (2026-09-15). Data as JSON: /api/errors/4e23313c12493652. Report an issue: GitHub.

Appendix: source

Thrown at MailKit/Security/Ntlm/NtlmMessageBase.cs:84

		}

		bool CheckSignature (byte[] message, int startIndex)
		{
			for (int i = 0; i < Signature.Length; i++) {
				if (message[startIndex + i] != Signature[i])
					return false;
			}

			return BitConverterLE.ToUInt32 (message, startIndex + 8) == Type;
		}

		protected void ValidateArguments (byte[] message, int startIndex, int length)
		{
			if (message == null)
				throw new ArgumentNullException (nameof (message));

			if (startIndex < 0 || startIndex > message.Length)
				throw new ArgumentOutOfRangeException (nameof (startIndex));

			if (length < 12 || length > (message.Length - startIndex))
				throw new ArgumentOutOfRangeException (nameof (length));

			if (!CheckSignature (message, startIndex))
				throw new ArgumentException (string.Format (CultureInfo.InvariantCulture, "Invalid Type{0} message.", Type), nameof (message));

			var messageType = BitConverterLE.ToUInt32 (message, 8);
			if (messageType != Type)
				throw new ArgumentException (string.Format (CultureInfo.InvariantCulture, "Invalid Type{0} message.", Type), nameof (message));
		}

		public abstract byte[] Encode ();
	}
}

View on GitHub (pinned to 9d3859a785)