peass-ng/PEASS-ng · error · ArgumentException

truncated BIT STRING detected

Error message

truncated BIT STRING detected

What it means

FromAsn1Octets (invoked via GetInstance) decodes the raw contents of a BIT STRING, where the first octet encodes the number of pad bits. An octet array shorter than 1 byte has no pad-count octet at all, so the encoding is truncated and ArgumentException is thrown.

Source

Thrown at winPEAS/winPEASexe/winPEAS/3rdParty/BouncyCastle/asn1/DerBitString.cs:255

        {
            StringBuilder buffer = new StringBuilder("#");

            byte[] str = GetDerEncoded();

            for (int i = 0; i != str.Length; i++)
            {
                uint ubyte = str[i];
                buffer.Append(table[(ubyte >> 4) & 0xf]);
                buffer.Append(table[str[i] & 0xf]);
            }

            return buffer.ToString();
        }

        internal static DerBitString FromAsn1Octets(byte[] octets)
        {
            if (octets.Length < 1)
                throw new ArgumentException("truncated BIT STRING detected", "octets");

            int padBits = octets[0];
            byte[] data = Arrays.CopyOfRange(octets, 1, octets.Length);

            if (padBits > 0 && padBits < 8 && data.Length > 0)
            {
                int last = data[data.Length - 1];
                int mask = (1 << padBits) - 1;

                if ((last & mask) != 0)
                {
                    return new BerBitString(data, padBits);
                }
            }

            return new DerBitString(data, padBits);
        }
    }

View on GitHub (pinned to 53fb989abc)

Solutions

1. Validate that the octet array length is >= 1 before decoding.
2. Fix the upstream slicing/parsing that produced the empty array (check tag/length handling).
3. Treat the source data as corrupt — re-export or re-parse the certificate/structure with a validating parser.

Example fix

// before
var bs = DerBitString.GetInstance(contentOctets);
// after
if (contentOctets == null || contentOctets.Length < 1)
    throw new InvalidDataException("BIT STRING content missing pad-count octet");
var bs = DerBitString.GetInstance(contentOctets);

if (octets == null || octets.Length < 1) throw new InvalidDataException("BIT STRING needs at least the pad-count octet");

static bool IsDecodableBitStringOctets(byte[] o) => o != null && o.Length >= 1;

try { var bs = DerBitString.GetInstance(octets); }
catch (ArgumentException) { /* truncated/corrupt DER: re-parse or reject input */ }

When it happens

Trigger: Calling DerBitString.GetInstance / FromAsn1Octets with an empty (zero-length) byte[] — e.g. an ASN.1 TLV whose content octets were mis-sliced or an empty BIT STRING read from a malformed certificate.

Common situations: Parsing corrupt or hand-crafted DER/PEM data; off-by-one slicing that drops the pad-count byte; certificate fields with zero-length BIT STRING contents.

Related errors

• data
• must be in the range 0 to 7
• if 'data' is empty, 'padBits' must be 0
• attempt to get non-octet aligned data from BIT STRING
• illegal object in GetInstance:

AI-assisted analysis of peass-ng/PEASS-ng@53fb989abc (2026-09-02). Data as JSON: /api/errors/e8307d25804ae672. Report an issue: GitHub.