peass-ng/PEASS-ng · error · ArgumentException

malformed enumerated

Error message

malformed enumerated

What it means

DerEnumerated(byte[]) validates the bytes as a minimal, properly signed DER integer encoding via DerInteger.IsMalformed (leading zero bytes, empty arrays, overlong encodings). Bytes that do not conform to a valid integer content encoding throw 'malformed enumerated'.

Source

Thrown at winPEAS/winPEASexe/winPEAS/3rdParty/BouncyCastle/asn1/DerEnumerated.cs:82

                throw new ArgumentException("enumerated must be non-negative", "val");

            this.bytes = BigInteger.ValueOf(val).ToByteArray();
            this.start = 0;
        }

        public DerEnumerated(BigInteger val)
        {
            if (val.SignValue < 0)
                throw new ArgumentException("enumerated must be non-negative", "val");

            this.bytes = val.ToByteArray();
            this.start = 0;
        }

        public DerEnumerated(byte[] bytes)
        {
            if (DerInteger.IsMalformed(bytes))
                throw new ArgumentException("malformed enumerated", "bytes");
            if (0 != (bytes[0] & 0x80))
                throw new ArgumentException("enumerated must be non-negative", "bytes");

            this.bytes = Arrays.Clone(bytes);
            this.start = DerInteger.SignBytesToSkip(bytes);
        }

        public BigInteger Value
        {
            get { return new BigInteger(bytes); }
        }

        public bool HasValue(BigInteger x)
        {
            return null != x
                // Fast check to avoid allocation
                && DerInteger.IntValue(bytes, start, DerInteger.SignExtSigned) == x.IntValue
                && Value.Equals(x);

View on GitHub (pinned to 53fb989abc)

Solutions

1. Pass only the content octets of the ENUMERATED TLV, not the whole record
2. Normalize the byte array (strip redundant leading octets) or take it from BigInteger.ToByteArray()
3. Verify with DerInteger.IsMalformed(bytes) before constructing
4. Catch ArgumentException and treat the source data as corrupt

Example fix

// before
var e = new DerEnumerated(rawTlvBytes);
// after
var content = Asn1Object.FromByteArray(rawTlvBytes) as Asn1OctetString; // or correct TLV slice
var e = new DerEnumerated(content.GetOctets());

bool valid = bytes != null && bytes.Length > 0 && !DerInteger.IsMalformed(bytes);

try { var e = new DerEnumerated(bytes); }
catch (ArgumentException) { /* quarantine corrupt record */ }

When it happens

Trigger: new DerEnumerated(bytes) where bytes is empty, contains redundant leading 0x00/0xFF octets, or is otherwise not a minimal two's-complement integer content, e.g. raw truncated DER content from a corrupted stream.

Common situations: Feeding raw TLV content that includes length/header bytes instead of just content octets; decoding records produced by buggy encoders that pad enumerated values.

Understand the failure class

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

Related errors

• unknown object encountered in constructed OCTET STRING:
• unknown tag {tagNo} encountered
• DER length more than 4 bytes:
• byte value should have 1 byte in it
• BOOLEAN value should have 1 byte in it

AI-assisted analysis of peass-ng/PEASS-ng@53fb989abc (2026-09-02). Data as JSON: /api/errors/6ac751fdba626e9a. Report an issue: GitHub.