peass-ng/PEASS-ng · error · ArgumentException

ENUMERATED has zero length

Error message

ENUMERATED has zero length

What it means

DerEnumerated.FromOctetString builds a DerEnumerated from raw OCTET STRING bytes and requires at least one byte of content, because a valid ASN.1 ENUMERATED value always encodes at least one octet. An empty byte array carries no value, so the library throws ArgumentException instead of producing a meaningless zero-length DER object.

Source

Thrown at winPEAS/winPEASexe/winPEAS/3rdParty/BouncyCastle/asn1/DerEnumerated.cs:141

            if (other == null)
                return false;

            return Arrays.AreEqual(this.bytes, other.bytes);
        }

        protected override int Asn1GetHashCode()
        {
            return Arrays.GetHashCode(bytes);
        }

        private static readonly DerEnumerated[] cache = new DerEnumerated[12];

        internal static DerEnumerated FromOctetString(byte[] enc)
        {
            if (enc.Length > 1)
                return new DerEnumerated(enc);
            if (enc.Length == 0)
                throw new ArgumentException("ENUMERATED has zero length", "enc");

            int value = enc[0];
            if (value >= cache.Length)
                return new DerEnumerated(enc);

            DerEnumerated possibleMatch = cache[value];
            if (possibleMatch == null)
            {
                cache[value] = possibleMatch = new DerEnumerated(enc);
            }
            return possibleMatch;
        }
    }
}

View on GitHub (pinned to 53fb989abc)

Solutions

1. Verify the byte array is non-empty before calling FromOctetString: if (enc == null || enc.Length == 0) handle or reject it
2. Regenerate or re-fetch the source data — a zero-length ENUMERATED indicates corrupt/truncated input
3. If treating empty as an error is wrong for your protocol, construct DerEnumerated via a different constructor with a valid long/int value

Example fix

// before
DerEnumerated val = DerEnumerated.FromOctetString(contentBytes);
// after
if (contentBytes == null || contentBytes.Length == 0)
    throw new FormatException("ENUMERATED content is empty");
DerEnumerated val = DerEnumerated.FromOctetString(contentBytes);

if (enc == null || enc.Length == 0)
    throw new FormatException("ENUMERATED content octets are empty");
DerEnumerated val = DerEnumerated.FromOctetString(enc);

static bool IsValidEnumeratedBytes(byte[] enc) => enc != null && enc.Length > 0;

try { var val = DerEnumerated.FromOctetString(enc); }
catch (ArgumentException ex) when (ex.Message.Contains("zero length")) {
    // treat input as malformed ASN.1
}

When it happens

Trigger: Calling DerEnumerated.FromOctetString with a zero-length byte array, typically the content octets extracted from a decoded ASN.1 object.

Common situations: Parsing malformed or truncated DER/BER data where an ENUMERATED element's content bytes were lost; hand-crafted byte arrays passed directly to FromOctetString; decoders that strip content from empty-value elements.

Related errors

• input vector too large
• No tagged object found in vector. Structure doesn't seem to
• too few objects in input vector
• malformed object
• must be in the range 0 to 7

AI-assisted analysis of peass-ng/PEASS-ng@53fb989abc (2026-09-02). Data as JSON: /api/errors/8a066e3eb663c18e. Report an issue: GitHub.