peass-ng/PEASS-ng · error · InvalidOperationException

DER length more than 4 bytes:

Error message

DER length more than 4 bytes: 

What it means

DerApplicationSpecific.GetLengthOfHeader parses the DER length-of-length field; if the long-form size indicator exceeds 4 bytes (invalid per X.690, including the forbidden 0xFF form) it throws InvalidOperationException 'DER length more than 4 bytes'. Lengths requiring more than 4 octets are not supported here.

Source

Thrown at winPEAS/winPEASexe/winPEAS/3rdParty/BouncyCastle/asn1/DerApplicationSpecific.cs:106

		private int GetLengthOfHeader(
			byte[] data)
		{
			int length = data[1]; // TODO: assumes 1 byte tag

			if (length == 0x80)
			{
				return 2;      // indefinite-length encoding
			}

			if (length > 127)
			{
				int size = length & 0x7f;

				// Note: The invalid long form "0xff" (see X.690 8.1.3.5c) will be caught here
				if (size > 4)
				{
					throw new InvalidOperationException("DER length more than 4 bytes: " + size);
				}

				return size + 2;
			}

			return 2;
		}

		public bool IsConstructed()
		{
			return isConstructed;
		}

		public byte[] GetContents()
		{
			return octets;
		}

View on GitHub (pinned to 53fb989abc)

Solutions

1. Validate/normalize input to proper DER (e.g. re-encode via BouncyCastle after successful parse) before it reaches this path
2. Reject input whose header bytes look non-DER (0x80|0xFF length-of-length) in a pre-scan
3. Regenerate the data with a compliant encoder if it came from an in-house tool
4. Catch InvalidOperationException and treat the blob as corrupt/untrusted

Example fix

// before
var app = DerApplicationSpecific.GetInstance(untrustedBytes);
// after
if (untrustedBytes.Length > 1 && (untrustedBytes[0] & 0x1f) == 0x1f && untrustedBytes[1] > 0x84)
    throw new InvalidDataException("unsupported/non-DER length header");
var app = DerApplicationSpecific.GetInstance(untrustedBytes);

// reject non-DER long-form length headers (>4 length octets)
bool HasConformantLength(byte[] d) { if (d.Length < 2 || (d[1] & 0x80) == 0) return true; int n = d[1] & 0x7f; return n > 0 && n <= 4; }

try { return DerApplicationSpecific.GetInstance(bytes); }
catch (InvalidOperationException ex) { throw new InvalidDataException("non-DER length header", ex); }

When it happens

Trigger: Parsing an ApplicationSpecific object whose header contains a long-form length with >4 subsequent length octets, or the invalid 0xFF length-of-length byte — corrupt or non-conformant DER input.

Common situations: Processing BER data encoded by non-conformant encoders; corrupted/crafted input with absurd length fields; accidentally parsing raw payload bytes as an ASN.1 header.

Related errors

• corrupted stream - invalid high tag number found
• unknown object encountered in constructed OCTET STRING:
• unknown tag {tagNo} encountered
• unexpected end-of-contents marker
• indefinite-length primitive encoding encountered

AI-assisted analysis of peass-ng/PEASS-ng@53fb989abc (2026-09-02). Data as JSON: /api/errors/882d6c1433be3688. Report an issue: GitHub.