peass-ng/PEASS-ng · error · ArgumentException

must be in the range [0,7]

Error message

must be in the range [0,7]

What it means

The extended DoFinal(output, outOff, outLen, partialByte, partialBits) supports appending a partial-byte suffix bits; partialBits must be 0-7 because only one partial byte can be encoded. The library throws ArgumentException('must be in the range [0,7]') otherwise.

Source

Thrown at winPEAS/winPEASexe/winPEAS/3rdParty/BouncyCastle/crypto/digests/ShakeDigest.cs:88

            return outLen;
        }

        /*
         * TODO Possible API change to support partial-byte suffixes.
         */
        protected override int DoFinal(byte[] output, int outOff, byte partialByte, int partialBits)
        {
            return DoFinal(output, outOff, GetDigestSize(), partialByte, partialBits);
        }

        /*
         * TODO Possible API change to support partial-byte suffixes.
         */
        protected virtual int DoFinal(byte[] output, int outOff, int outLen, byte partialByte, int partialBits)
        {
            if (partialBits < 0 || partialBits > 7)
                throw new ArgumentException("must be in the range [0,7]", "partialBits");

            int finalInput = (partialByte & ((1 << partialBits) - 1)) | (0x0F << partialBits);
            Debug.Assert(finalInput >= 0);
            int finalBits = partialBits + 4;

            if (finalBits >= 8)
            {
                Absorb((byte)finalInput);
                finalBits -= 8;
                finalInput >>= 8;
            }

            if (finalBits > 0)
            {
                AbsorbBits(finalInput, finalBits);
            }

            Squeeze(output, outOff, (long)outLen << 3);

View on GitHub (pinned to 53fb989abc)

Solutions

1. Pass partialBits in [0,7]; mask/normalize the bit count before the call.
2. Ensure partialByte only contains the low partialBits bits.
3. Use the simple DoFinal(output, outOff) overload if you have no partial-byte suffix.

Example fix

// before
DoFinal(output, outOff, outLen, partialByte, 8);
// after
DoFinal(output, outOff, outLen, partialByte & 0xFF, partialBits % 8);

if (partialBits < 0 || partialBits > 7) throw new ArgumentOutOfRangeException(nameof(partialBits));

bool IsValidPartialBits(int partialBits) => (uint)partialBits <= 7;

try { DoFinal(output, outOff, outLen, partialByte, partialBits); }
catch (ArgumentException ex) when (ex.ParamName == "partialBits") { DoFinal(output, outOff, outLen, 0, 0); }

When it happens

Trigger: Calling the protected DoFinal overload (e.g. from a subclass or via TupleHash/ParallelHash) with partialBits < 0 or > 7, e.g. 8 or a negative leftover counter.

Common situations: Implementing a custom cSHAKE-style wrapper and mis-tracking how many leftover bits remain in the final byte.

Related errors

• not supported for SHAKE
• BLAKE2b digest bit length must be a multiple of 8 and not gr
• Invalid digest length (required: 1 - 64)
• BLAKE2s digest bit length must be a multiple of 8 and not gr
• must be in the range 1 to 7

AI-assisted analysis of peass-ng/PEASS-ng@53fb989abc (2026-09-02). Data as JSON: /api/errors/05a7ffeb572f9086. Report an issue: GitHub.