peass-ng/PEASS-ng · error · IOException

corrupted stream - invalid high tag number found

Error message

corrupted stream - invalid high tag number found

What it means

An ASN.1 header validation in ReadTagNumber: for a high tag number form (tagNo == 0x1f), X.690 8.1.2.4.2 requires that bits 7-1 of the first subsequent octet are not all zero; the parser read an octet whose low 7 bits are zero (EOF -1 also passes this check) and rejects the stream. It fires on malformed tag encodings or truncated input.

Source

Thrown at winPEAS/winPEASexe/winPEAS/3rdParty/BouncyCastle/asn1/Asn1InputStream.cs:255

        internal static int ReadTagNumber(
            Stream s,
            int tag)
        {
            int tagNo = tag & 0x1f;

            //
            // with tagged object tag number is bottom 5 bits, or stored at the start of the content
            //
            if (tagNo == 0x1f)
            {
                tagNo = 0;

                int b = s.ReadByte();

                // X.690-0207 8.1.2.4.2
                // "c) bits 7 to 1 of the first subsequent octet shall not all be zero."
                if ((b & 0x7f) == 0) // Note: -1 will pass
                    throw new IOException("corrupted stream - invalid high tag number found");

                while ((b >= 0) && ((b & 0x80) != 0))
                {
                    tagNo |= (b & 0x7f);
                    tagNo <<= 7;
                    b = s.ReadByte();
                }

                if (b < 0)
                    throw new EndOfStreamException("EOF found inside tag value.");

                tagNo |= (b & 0x7f);
            }

            return tagNo;
        }

        internal static int ReadLength(Stream s, int limit, bool isParsing)

View on GitHub (pinned to 53fb989abc)

Solutions

1. Regenerate the ASN.1 data with a conforming encoder so high tag numbers use minimal octet encoding
2. Validate/truncate-check the byte stream before parsing
3. Catch IOException and treat the document as malformed/corrupted

When it happens

Trigger: Thrown at winPEAS/winPEASexe/winPEAS/3rdParty/BouncyCastle/asn1/Asn1InputStream.cs:255 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of peass-ng/PEASS-ng@53fb989abc (2026-09-02). Data as JSON: /api/errors/9d9953324f90b892. Report an issue: GitHub.