peass-ng/PEASS-ng · error · EndOfStreamException

EOF encountered in middle of BMPString

Error message

EOF encountered in middle of BMPString

What it means

Thrown by GetBmpCharBuffer while converting a definite-length BMPString's contents into a char buffer: the underlying stream ended before all of the BMP string's bytes could be read, so the encoding claims more content bytes than the stream actually contains.

Source

Thrown at winPEAS/winPEASexe/winPEAS/3rdParty/BouncyCastle/asn1/Asn1InputStream.cs:343

            defIn.ReadAllIntoByteArray(buf);

            return buf;
        }

        private static char[] GetBmpCharBuffer(DefiniteLengthInputStream defIn)
        {
            int remainingBytes = defIn.Remaining;
            if (0 != (remainingBytes & 1))
                throw new IOException("malformed BMPString encoding encountered");

            char[] str = new char[remainingBytes / 2];
            int stringPos = 0;

            byte[] buf = new byte[8];
            while (remainingBytes >= 8)
            {
                if (Streams.ReadFully(defIn, buf, 0, 8) != 8)
                    throw new EndOfStreamException("EOF encountered in middle of BMPString");

                str[stringPos] = (char)((buf[0] << 8) | (buf[1] & 0xFF));
                str[stringPos + 1] = (char)((buf[2] << 8) | (buf[3] & 0xFF));
                str[stringPos + 2] = (char)((buf[4] << 8) | (buf[5] & 0xFF));
                str[stringPos + 3] = (char)((buf[6] << 8) | (buf[7] & 0xFF));
                stringPos += 4;
                remainingBytes -= 8;
            }
            if (remainingBytes > 0)
            {
                if (Streams.ReadFully(defIn, buf, 0, remainingBytes) != remainingBytes)
                    throw new EndOfStreamException("EOF encountered in middle of BMPString");

                int bufPos = 0;
                do
                {
                    int b1 = buf[bufPos++] << 8;
                    int b2 = buf[bufPos++] & 0xFF;

View on GitHub (pinned to 53fb989abc)

Solutions

1. Verify the input length matches the ASN.1 structure (complete file/blob)
2. Buffer the whole source into a byte[] before parsing so the parser sees a self-consistent stream
3. Re-download/re-copy the data; check transfer integrity
4. Catch EndOfStreamException and treat the certificate/blob as truncated

Example fix

// before
Asn1Object o = new Asn1InputStream(partialStream).ReadObject();
// after
if (partialStream.CanSeek && partialStream.Position != 0) partialStream.Position = 0;
byte[] all = ReadAllBytes(partialStream);
Asn1Object o = Asn1Object.FromByteArray(all);

static bool IsCompleteFile(string path)
{
    var fi = new FileInfo(path);
    return fi.Exists && fi.Length > 0; // plus upstream integrity checks (hash/size)
}

try { Asn1Object o = Asn1Object.FromByteArray(data); }
catch (EndOfStreamException)
{
    // BMPString (or object) content truncated mid-read
}

When it happens

Trigger: A primitive BMPString whose definite-length content exceeds the actual bytes remaining in the stream (truncated input, or the DefiniteLengthInputStream hit EOF mid-string).

Common situations: Certificate files cut off mid-transfer; streams read after an earlier consumer already drained them; truncated embedded blobs in logs/databases.

Related errors

• EOF found reading length
• malformed BMPString encoding encountered
• DEF length object truncated by
• truncated BIT STRING detected
• malformed BMPString encoding encountered

AI-assisted analysis of peass-ng/PEASS-ng@53fb989abc (2026-09-02). Data as JSON: /api/errors/1ac4b4114d3f7d9e. Report an issue: GitHub.