peass-ng/PEASS-ng · warning · ArithmeticException

ASN.1 Enumerated out of int range

Error message

ASN.1 Enumerated out of int range

What it means

IntValueExact returns the enumerated value as an int and throws ArithmeticException (not ArgumentException) when the magnitude requires more than 4 content bytes, since it cannot fit in an int without truncation. This is a deliberate lossless-conversion guard.

Source

Thrown at winPEAS/winPEASexe/winPEAS/3rdParty/BouncyCastle/asn1/DerEnumerated.cs:109

        {
            get { return new BigInteger(bytes); }
        }

        public bool HasValue(BigInteger x)
        {
            return null != x
                // Fast check to avoid allocation
                && DerInteger.IntValue(bytes, start, DerInteger.SignExtSigned) == x.IntValue
                && Value.Equals(x);
        }

        public int IntValueExact
        {
            get
            {
                int count = bytes.Length - start;
                if (count > 4)
                    throw new ArithmeticException("ASN.1 Enumerated out of int range");

                return DerInteger.IntValue(bytes, start, DerInteger.SignExtSigned);
            }
        }

        internal override void Encode(DerOutputStream derOut)
        {
            derOut.WriteEncoded(Asn1Tags.Enumerated, bytes);
        }

        protected override bool Asn1Equals(Asn1Object asn1Object)
        {
            DerEnumerated other = asn1Object as DerEnumerated;
            if (other == null)
                return false;

            return Arrays.AreEqual(this.bytes, other.bytes);
        }

View on GitHub (pinned to 53fb989abc)

Solutions

1. Use the Value property (BigInteger) instead of IntValueExact when large values are possible
2. Check (bytes.Length - start) <= 4 / check Value.BitLength before calling IntValueExact
3. Reject out-of-range values as invalid input since legal enumerations are small
4. Catch ArithmeticException and fall back to BigInteger handling

Example fix

// before
int v = enumerated.IntValueExact;
// after
BigInteger big = enumerated.Value;
if (!big.fitsInt) /* handle */ else int v = enumerated.IntValueExact;

bool fitsInt = (enumerated.bytes.Length - enumerated.start) <= 4; // or check enumerated.Value via BigInteger range

try { int v = enumerated.IntValueExact; }
catch (ArithmeticException) { BigInteger big = enumerated.Value; /* handle big value */ }

When it happens

Trigger: Calling derEnumerated.IntValueExact on an ENUMERATED whose encoded length (bytes.Length - start) exceeds 4 bytes, e.g. a maliciously or mistakenly oversized enumerated in a parsed certificate.

Common situations: Parsing untrusted PKI data containing absurdly large ENUMERATED encodings; assuming enumerated values are small ints while an encoder wrote a big-number encoding.

Related errors

• enumerated must be non-negative
• unknown object encountered in constructed OCTET STRING:
• unknown tag {tagNo} encountered
• unexpected end-of-contents marker
• indefinite-length primitive encoding encountered

AI-assisted analysis of peass-ng/PEASS-ng@53fb989abc (2026-09-02). Data as JSON: /api/errors/8442085e3a9a055f. Report an issue: GitHub.