peass-ng/PEASS-ng · error · IOException

corrupted stream - invalid high tag number found

Error message

corrupted stream - invalid high tag number found

What it means

DerApplicationSpecific.ReplaceTagNumber scans the original header for a high-tag-number encoding; per X.690 8.1.2.4.2c, the first subsequent tag octet must not be zero, and if it is (or the header shape is inconsistent) it throws IOException 'corrupted stream - invalid high tag number found'. The input's high tag number encoding is malformed.

Source

Thrown at winPEAS/winPEASexe/winPEAS/3rdParty/BouncyCastle/asn1/DerApplicationSpecific.cs:210

			return isConstructed.GetHashCode() ^ tag.GetHashCode() ^ Arrays.GetHashCode(octets);
		}

		private byte[] ReplaceTagNumber(
			int newTag,
			byte[] input)
		{
			int tagNo = input[0] & 0x1f;
			int index = 1;

			// with tagged object tag number is bottom 5 bits, or stored at the start of the content
			if (tagNo == 0x1f)
			{
				int b = input[index++];

				// X.690-0207 8.1.2.4.2
				// "c) bits 7 to 1 of the first subsequent octet shall not all be zero."
				if ((b & 0x7f) == 0) // Note: -1 will pass
					throw new IOException("corrupted stream - invalid high tag number found");

				while ((b & 0x80) != 0)
				{
					b = input[index++];
				}
			}

			int remaining = input.Length - index;
			byte[] tmp = new byte[1 + remaining];
			tmp[0] = (byte)newTag;
			Array.Copy(input, index, tmp, 1, remaining);
			return tmp;
		}
	}
}

View on GitHub (pinned to 53fb989abc)

Solutions

1. Verify the source data is DER-compliant (first tag octet 0x1f requires nonzero subsequent tag bits)
2. Re-encode the object with a compliant encoder before processing
3. If the tag number is actually < 31, fix the encoder to use the low-tag form (no 0x1f prefix)
4. Catch IOException and reject as corrupt input

Example fix

// before
var o = DerApplicationSpecific.GetInstance(craftedBytes); // 0x1f 0x00... header
// after
if (craftedBytes[0] == 0x1f && craftedBytes[1] == 0x00)
    throw new InvalidDataException("invalid high tag number (X.690 8.1.2.4.2c)");
var o = DerApplicationSpecific.GetInstance(craftedBytes);

// X.690 8.1.2.4.2c: first subsequent tag octet must not be zero
bool HasValidHighTag(byte[] d) { if (d.Length < 2 || (d[0] & 0x1f) != 0x1f) return true; return (d[1] & 0x7f) != 0; }

try { var o = app.GetObject(tagNo); }
catch (IOException ex) { throw new InvalidDataException("malformed high tag number", ex); }

When it happens

Trigger: GetObject/ReplaceTagNumber on an ApplicationSpecific object whose encoded header uses a high tag number form (first tag byte 0x1f) with a zero-valued following octet (e.g. 0x1f 0x00) or otherwise malformed multi-byte tag bytes.

Common situations: Hand-crafted or encoder-buggy ASN.1 with malformed high tag numbers; bit-corrupted data in transit; fuzzed/hostile input.

Related errors

• DER length more than 4 bytes:
• unknown object encountered in constructed OCTET STRING:
• unknown tag {tagNo} encountered
• unexpected end-of-contents marker
• indefinite-length primitive encoding encountered

AI-assisted analysis of peass-ng/PEASS-ng@53fb989abc (2026-09-02). Data as JSON: /api/errors/937271646f945d33. Report an issue: GitHub.