peass-ng/PEASS-ng · error · ArgumentException

BOOLEAN value should have 1 byte in it

Error message

BOOLEAN value should have 1 byte in it

What it means

FromOctetString is the internal path used when unwrapping an Asn1OctetString into a DerBoolean (e.g. from tagged/encoded content). ASN.1 BOOLEAN content must be exactly one octet, so a value array of another length throws this ArgumentException before any byte is read.

Source

Thrown at winPEAS/winPEASexe/winPEAS/3rdParty/BouncyCastle/asn1/DerBoolean.cs:115

            return IsTrue == other.IsTrue;
        }

        protected override int Asn1GetHashCode()
        {
            return IsTrue.GetHashCode();
        }

        public override string ToString()
        {
            return IsTrue ? "TRUE" : "FALSE";
        }

        internal static DerBoolean FromOctetString(byte[] value)
        {
            if (value.Length != 1)
            {
                throw new ArgumentException("BOOLEAN value should have 1 byte in it", "value");
            }

            byte b = value[0];

            return b == 0 ? False : b == 0xFF ? True : new DerBoolean(value);
        }
    }
}

View on GitHub (pinned to 53fb989abc)

Solutions

1. Check value.Length == 1 before conversion and treat other lengths as a parse error
2. Fix the producing encoder so BOOLEAN is encoded as a single 0x00/0xFF octet
3. Re-verify offsets: you may be reading the wrong TLV so extra bytes leak into the value
4. Catch ArgumentException and skip/fail the record gracefully

Example fix

// before
var b = DerBoolean.FromOctetString(octets);
// after
var b = octets.Length == 1 ? DerBoolean.FromOctetString(octets) : null;
if (b == null) { /* malformed BOOLEAN */ }

if (value == null || value.Length != 1) throw new FormatException("BOOLEAN octets must be length 1");

bool IsSingleByte(byte[] v) => v != null && v.Length == 1;

try { var b = DerBoolean.FromOctetString(value); }
catch (ArgumentException) { /* mark element invalid and continue/skip */ }

When it happens

Trigger: GetInstance on a tagged/encoded object whose underlying octets are longer or shorter than 1 byte; parsing a BER/DER BOOLEAN record whose content-length octet is not 0x01.

Common situations: Decoding certificates or protocol messages produced by a non-conformant encoder; truncated or corrupted DER streams; mislabeled fields where an OCTET STRING of arbitrary size is fed where a BOOLEAN is expected.

Related errors

• unknown object encountered in constructed OCTET STRING:
• unknown tag {tagNo} encountered
• DER length more than 4 bytes:
• unexpected end-of-contents marker
• indefinite-length primitive encoding encountered

AI-assisted analysis of peass-ng/PEASS-ng@53fb989abc (2026-09-02). Data as JSON: /api/errors/b2008b31021d24bf. Report an issue: GitHub.