peass-ng/PEASS-ng · error · ArgumentException

must be in the range 0 to 7

Error message

must be in the range 0 to 7

What it means

DerBitString's padBits parameter counts the number of unused (padding) bits in the final byte and must be between 0 and 7, since a byte can hold at most 7 unused bits. The constructor throws ArgumentException when padBits is negative or >= 8 to prevent producing an invalid DER BIT STRING encoding.

Source

Thrown at winPEAS/winPEASexe/winPEAS/3rdParty/BouncyCastle/asn1/DerBitString.cs:79

            {
                return GetInstance(o);
            }

            return FromAsn1Octets(((Asn1OctetString)o).GetOctets());
        }

        /**
		 * @param data the octets making up the bit string.
		 * @param padBits the number of extra bits at the end of the string.
		 */
        public DerBitString(
            byte[] data,
            int padBits)
        {
            if (data == null)
                throw new ArgumentNullException("data");
            if (padBits < 0 || padBits > 7)
                throw new ArgumentException("must be in the range 0 to 7", "padBits");
            if (data.Length == 0 && padBits != 0)
                throw new ArgumentException("if 'data' is empty, 'padBits' must be 0");

            this.mData = Arrays.Clone(data);
            this.mPadBits = padBits;
        }

        public DerBitString(
            byte[] data)
            : this(data, 0)
        {
        }

        public DerBitString(
            int namedBits)
        {
            if (namedBits == 0)
            {

View on GitHub (pinned to 53fb989abc)

Solutions

1. Pass only the number of unused bits in the LAST byte (0–7); for octet-aligned data pass 0.
2. Compute padBits as (8 - (bitCount % 8)) % 8 rather than passing the raw bit count.
3. If you have full bytes with no partial bits, use new DerBitString(data) / padBits 0.

Example fix

// before
int bits = data.Length * 8;
var bs = new DerBitString(data, bits); // always throws
// after
var bs = new DerBitString(data, 0); // octet-aligned data uses 0 pad bits

if (padBits < 0 || padBits > 7) throw new ArgumentOutOfRangeException(nameof(padBits), padBits, "must be 0-7");

static bool IsValidPadBits(int p) => p >= 0 && p <= 7;

When it happens

Trigger: Calling new DerBitString(data, n) where n < 0 or n > 7 — e.g. passing a bit count, a byte-length, or an unmasked value like data.Length * 8 as padBits.

Common situations: Hand-rolling ASN.1 encoders that confuse padBits with total bit length; computing padding from wrong endianness or forgetting to mask a length byte read from a stream.

Related errors

• if 'data' is empty, 'padBits' must be 0
• malformed object
• data
• attempt to get non-octet aligned data from BIT STRING
• truncated BIT STRING detected

AI-assisted analysis of peass-ng/PEASS-ng@53fb989abc (2026-09-02). Data as JSON: /api/errors/6d4f8cd674a3649d. Report an issue: GitHub.