peass-ng/PEASS-ng · error · ArgumentException

enumerated must be non-negative

Error message

enumerated must be non-negative

What it means

ASN.1 ENUMERATED values are defined as non-negative. This constructor overload taking an int rejects negative values with an ArgumentException before encoding, because a negative enumerated has no valid DER representation here.

Source

Thrown at winPEAS/winPEASexe/winPEAS/3rdParty/BouncyCastle/asn1/DerEnumerated.cs:55

         */
        public static DerEnumerated GetInstance(
            Asn1TaggedObject obj,
            bool isExplicit)
        {
            Asn1Object o = obj.GetObject();

            if (isExplicit || o is DerEnumerated)
            {
                return GetInstance(o);
            }

            return FromOctetString(((Asn1OctetString)o).GetOctets());
        }

        public DerEnumerated(int val)
        {
            if (val < 0)
                throw new ArgumentException("enumerated must be non-negative", "val");

            this.bytes = BigInteger.ValueOf(val).ToByteArray();
            this.start = 0;
        }

        public DerEnumerated(long val)
        {
            if (val < 0L)
                throw new ArgumentException("enumerated must be non-negative", "val");

            this.bytes = BigInteger.ValueOf(val).ToByteArray();
            this.start = 0;
        }

        public DerEnumerated(BigInteger val)
        {
            if (val.SignValue < 0)
                throw new ArgumentException("enumerated must be non-negative", "val");

View on GitHub (pinned to 53fb989abc)

Solutions

1. Clamp or map negative sentinels to a valid non-negative enumerated value before constructing
2. Validate val >= 0 at the application boundary and reject earlier with a clearer message
3. If signed semantics are needed, the type is wrong - use DerInteger instead
4. Catch ArgumentException to surface which input was negative

Example fix

// before
var e = new DerEnumerated(statusCode);
// after
var e = statusCode >= 0 ? new DerEnumerated(statusCode) : new DerEnumerated(0);

if (val < 0) throw new ArgumentOutOfRangeException(nameof(val), "enumerated must be non-negative");

try { var e = new DerEnumerated(val); }
catch (ArgumentException) { /* clamp or reject negative input */ }

When it happens

Trigger: new DerEnumerated(someInt) where someInt < 0, typically when mapping application enums/status codes that use -1 as a sentinel into ASN.1.

Common situations: Sending CRL entry reasons, cert status codes, or protocol enumerations where a 'not set' value of -1 is passed straight through; subtracting values that can underflow below zero.

Related errors

• illegal object in GetInstance:
• byte value should have 1 byte in it
• illegal object in GetInstance:
• ASN.1 Enumerated out of int range
• unknown object encountered in constructed OCTET STRING:

AI-assisted analysis of peass-ng/PEASS-ng@53fb989abc (2026-09-02). Data as JSON: /api/errors/332f3ee1fc3ef98e. Report an issue: GitHub.