peass-ng/PEASS-ng · error · ArgumentException

if 'data' is empty, 'padBits' must be 0

Error message

if 'data' is empty, 'padBits' must be 0

What it means

A DER BIT STRING with an empty payload is only valid when there are no pad bits; if data is empty but padBits != 0 the encoding is contradictory (padding bits describing bits that do not exist). The constructor throws ArgumentException for this combination.

Source

Thrown at winPEAS/winPEASexe/winPEAS/3rdParty/BouncyCastle/asn1/DerBitString.cs:81

            }

            return FromAsn1Octets(((Asn1OctetString)o).GetOctets());
        }

        /**
		 * @param data the octets making up the bit string.
		 * @param padBits the number of extra bits at the end of the string.
		 */
        public DerBitString(
            byte[] data,
            int padBits)
        {
            if (data == null)
                throw new ArgumentNullException("data");
            if (padBits < 0 || padBits > 7)
                throw new ArgumentException("must be in the range 0 to 7", "padBits");
            if (data.Length == 0 && padBits != 0)
                throw new ArgumentException("if 'data' is empty, 'padBits' must be 0");

            this.mData = Arrays.Clone(data);
            this.mPadBits = padBits;
        }

        public DerBitString(
            byte[] data)
            : this(data, 0)
        {
        }

        public DerBitString(
            int namedBits)
        {
            if (namedBits == 0)
            {
                this.mData = new byte[0];
                this.mPadBits = 0;

View on GitHub (pinned to 53fb989abc)

Solutions

1. Pass padBits 0 when data is empty, or avoid constructing the string at all for empty input.
2. Guard the call: only compute/pass a nonzero padBits when data.Length > 0.
3. If the value is truly empty, use DerBitString.Empty or a null-typed ASN.1 object instead.

Example fix

// before
var bs = new DerBitString(data, padBits); // data may be empty with padBits 5
// after
var bs = data.Length == 0 ? new DerBitString(new byte[0], 0) : new DerBitString(data, padBits);

if (data.Length == 0 && padBits != 0) padBits = 0; // or reject the call

static bool IsEncodableBitString(byte[] d, int pad) => d.Length > 0 || pad == 0;

When it happens

Trigger: Calling new DerBitString(new byte[0], padBits) with any padBits from 1 to 7.

Common situations: Encoding empty flags/bitmask values; code that trims a buffer to empty but keeps a previously computed padBits value.

Related errors

• must be in the range 0 to 7
• malformed object
• data
• attempt to get non-octet aligned data from BIT STRING
• truncated BIT STRING detected

AI-assisted analysis of peass-ng/PEASS-ng@53fb989abc (2026-09-02). Data as JSON: /api/errors/3cd9533315a5c4e7. Report an issue: GitHub.