peass-ng/PEASS-ng · error · IOException

DER length more than 4 bytes:

Error message

DER length more than 4 bytes: 

What it means

Asn1InputStream.ReadLength validates the long-form DER length field. X.690 allows at most 4 length bytes (max ~4GB), so when the low 7 bits of the first length byte indicate more than 4 following length octets, the stream is not valid DER and an IOException is thrown.

Source

Thrown at winPEAS/winPEASexe/winPEAS/3rdParty/BouncyCastle/asn1/Asn1InputStream.cs:288

            return tagNo;
        }

        internal static int ReadLength(Stream s, int limit, bool isParsing)
        {
            int length = s.ReadByte();
            if (length < 0)
                throw new EndOfStreamException("EOF found when length expected");

            if (length == 0x80)
                return -1;      // indefinite-length encoding

            if (length > 127)
            {
                int size = length & 0x7f;

                // Note: The invalid long form "0xff" (see X.690 8.1.3.5c) will be caught here
                if (size > 4)
                    throw new IOException("DER length more than 4 bytes: " + size);

                length = 0;
                for (int i = 0; i < size; i++)
                {
                    int next = s.ReadByte();

                    if (next < 0)
                        throw new EndOfStreamException("EOF found reading length");

                    length = (length << 8) + next;
                }

                if (length < 0)
                    throw new IOException("corrupted stream - negative length found");

                if (length >= limit && !isParsing)   // after all we must have read at least 1 byte
                    throw new IOException("corrupted stream - out of bounds length found: " + length + " >= " + limit);
            }

View on GitHub (pinned to 53fb989abc)

Solutions

1. Verify the input is valid DER/BER and correctly base64-decoded before passing to Asn1InputStream
2. Check the offset/position where parsing begins; re-align to the actual start of the ASN.1 structure
3. Re-acquire the file/blob from a trusted source; the data is likely corrupted or truncated
4. If data may be untrusted, wrap ReadObject in try-catch and reject the input

Example fix

// before
byte[] raw = File.ReadAllBytes(pemPath); // still PEM text
Asn1Object o = Asn1Object.FromByteArray(raw);
// after
string b64 = ExtractBase64Body(File.ReadAllText(pemPath));
byte[] der = Convert.FromBase64String(b64);
Asn1Object o = Asn1Object.FromByteArray(der);

static bool LooksLikeDerLength(byte[] data)
{
    if (data == null || data.Length < 2) return false;
    int lenByte = data[1];
    if (lenByte <= 0x7f) return true;                 // short form
    int size = lenByte & 0x7f;                        // long form
    return size >= 1 && size <= 4 && data.Length >= 2 + size;
}

try { Asn1Object o = Asn1Object.FromByteArray(data); }
catch (IOException ex) when (ex.Message.StartsWith("DER length"))
{
    // input is not valid DER
}

When it happens

Trigger: Parsing a byte array or stream whose first length byte is 0x85-0xFF (long form with size > 4), typically because the data is not DER/BER encoded, is corrupted, or is being read at a wrong offset.

Common situations: Decrypting/parsing certificates, PFX, or signatures from corrupted files; feeding a PEM body without base64 decoding; misaligned stream offsets; truncated or maliciously crafted ASN.1 blobs.

Related errors

• unknown object encountered in constructed OCTET STRING:
• unknown tag {tagNo} encountered
• BOOLEAN value should have 1 byte in it
• unexpected end-of-contents marker
• indefinite-length primitive encoding encountered

AI-assisted analysis of peass-ng/PEASS-ng@53fb989abc (2026-09-02). Data as JSON: /api/errors/c2ca003dcc6ff2ba. Report an issue: GitHub.