peass-ng/PEASS-ng · error · IOException

corrupted stream - out of bounds length found:

Error message

corrupted stream - out of bounds length found: 

What it means

DefiniteLengthInputStream.ToArray validates that the declared definite length (_remaining) fits within the enclosing stream's Limit before allocating; if _remaining >= limit it throws IOException 'corrupted stream - out of bounds length found'. This guards against a DER length header claiming more bytes than the stream can contain.

Source

Thrown at winPEAS/winPEASexe/winPEAS/3rdParty/BouncyCastle/asn1/DefiniteLengthInputStream.cs:101

			// make sure it's safe to do this!
			int limit = Limit;
			if (_remaining >= limit)
				throw new IOException("corrupted stream - out of bounds length found: " + _remaining + " >= " + limit);

			if ((_remaining -= Streams.ReadFully(_in, buf)) != 0)
				throw new EndOfStreamException("DEF length " + _originalLength + " object truncated by " + _remaining);
			SetParentEofDetect(true);
		}

		internal byte[] ToArray()
		{
			if (_remaining == 0)
				return EmptyBytes;

			// make sure it's safe to do this!
			int limit = Limit;
			if (_remaining >= limit)
				throw new IOException("corrupted stream - out of bounds length found: " + _remaining + " >= " + limit);

			byte[] bytes = new byte[_remaining];
			if ((_remaining -= Streams.ReadFully(_in, bytes)) != 0)
				throw new EndOfStreamException("DEF length " + _originalLength + " object truncated by " + _remaining);
			SetParentEofDetect(true);
			return bytes;
		}
	}
}

View on GitHub (pinned to 53fb989abc)

Solutions

1. Verify the file is complete: compare its size against the expected encoded length
2. Re-download/re-export the blob; check for ASCII-mode transfers corrupting binary data
3. If parsing a fragment of a larger structure, pass the correct slice length to the stream
4. Treat as untrusted input: catch IOException and reject the data (this is an intentional anti-DoS guard)

Example fix

// before
Asn1Object o = Asn1Object.FromStream(possiblyTruncatedStream);
// after
if (streamData.Length < 2) throw new InvalidDataException("too short for DER");
int declared = GetDerLength(streamData); // validate header vs data.Length first
if (declared > streamData.Length - headerSize) throw new InvalidDataException("truncated DER");
Asn1Object o = Asn1Object.FromStream(new MemoryStream(streamData));

// ensure stream data length is consistent with DER header before parsing
int ReadDerLength(byte[] d, out int headerSize) { int n = d[1] & 0x7f; headerSize = 2; if ((d[1] & 0x80) != 0) { headerSize = 2 + n; } return n; }

try { return Asn1Object.FromStream(ms); }
catch (IOException ex) { throw new InvalidDataException("corrupted or truncated ASN.1 stream", ex); }

When it happens

Trigger: Parsing a stream whose ASN.1 object header declares a length larger than the total available data — corrupted or maliciously crafted length fields, truncated files, or a stream shorter than the encoded structure.

Common situations: Opening a truncated certificate/CRL/PKCS#7 file; loading files corrupted by bad transfers (FTP ASCII mode, partial downloads); parsing hostile input with oversized length fields (DoS guard).

Related errors

• DEF length object truncated by
• unknown object encountered in constructed OCTET STRING:
• unknown tag {tagNo} encountered
• unexpected end-of-contents marker
• indefinite-length primitive encoding encountered

AI-assisted analysis of peass-ng/PEASS-ng@53fb989abc (2026-09-02). Data as JSON: /api/errors/0568558a67fec94f. Report an issue: GitHub.