peass-ng/PEASS-ng · error · IOException

corrupted stream - out of bounds length found:

Error message

corrupted stream - out of bounds length found: 

What it means

ReadLength found a decoded length that is >= the stream's limit while the stream is not in parsing (indefinite) mode, meaning the object claims more bytes than the whole input contains. This guards against impossible/corrupt lengths.

Source

Thrown at winPEAS/winPEASexe/winPEAS/3rdParty/BouncyCastle/asn1/Asn1InputStream.cs:305

                if (size > 4)
                    throw new IOException("DER length more than 4 bytes: " + size);

                length = 0;
                for (int i = 0; i < size; i++)
                {
                    int next = s.ReadByte();

                    if (next < 0)
                        throw new EndOfStreamException("EOF found reading length");

                    length = (length << 8) + next;
                }

                if (length < 0)
                    throw new IOException("corrupted stream - negative length found");

                if (length >= limit && !isParsing)   // after all we must have read at least 1 byte
                    throw new IOException("corrupted stream - out of bounds length found: " + length + " >= " + limit);
            }

            return length;
        }

        private static byte[] GetBuffer(DefiniteLengthInputStream defIn, byte[][] tmpBuffers)
        {
            int len = defIn.Remaining;
            if (len >= tmpBuffers.Length)
            {
                return defIn.ToArray();
            }

            byte[] buf = tmpBuffers[len];
            if (buf == null)
            {
                buf = tmpBuffers[len] = new byte[len];
            }

View on GitHub (pinned to 53fb989abc)

Solutions

1. Check that the byte slice passed in covers the complete ASN.1 object (re-extract with correct offsets)
2. Increase/verify the limit argument when constructing Asn1InputStream if the data is genuinely larger
3. Validate the source file is complete and untruncated (compare sizes/hashes)
4. Catch IOException and reject rather than retry parsing the same bytes

Example fix

// before
byte[] slice = new byte[100]; // hard-coded guess
Array.Copy(blob, 0, slice, 0, 100);
Asn1Object o = Asn1Object.FromByteArray(slice);
// after
Asn1Object o = Asn1Object.FromByteArray(blob); // parse the complete blob

static bool FitsInInput(byte[] data)
{
    if (data == null || data.Length < 2) return false;
    int lb = data[1];
    long declared = lb <= 0x7f ? lb : -1;
    if (declared < 0)
    {
        int size = lb & 0x7f;
        if (size < 1 || size > 4 || data.Length < 2 + size) return false;
        declared = 0;
        for (int i = 0; i < size; i++) declared = (declared << 8) | data[2 + i];
    }
    return declared < data.Length - 2;
}

try { Asn1Object o = Asn1Object.FromByteArray(slice); }
catch (IOException ex) when (ex.Message.Contains("out of bounds length"))
{
    // slice too small or length field corrupt
}

When it happens

Trigger: Declaring a length larger than the remaining input, e.g. a truncated file whose header claims a multi-KB body, or crafted input with a huge length value equal to or exceeding the buffer size passed to Asn1InputStream(data.Length).

Common situations: Partially written or truncated certificate stores; wrong slice of a larger blob passed to FromByteArray; limit set too small when constructing Asn1InputStream.

Related errors

• unknown object encountered in constructed OCTET STRING:
• unknown tag {tagNo} encountered
• DER length more than 4 bytes:
• EOF found reading length
• corrupted stream - negative length found

AI-assisted analysis of peass-ng/PEASS-ng@53fb989abc (2026-09-02). Data as JSON: /api/errors/bd0cced42ebb8e51. Report an issue: GitHub.