sqlmapproject/sqlmap · error · ValueError

indefinite-length DER is not permitted

Error message

indefinite-length DER is not permitted

What it means

peel rejects DER with the indefinite-length form (first length byte 0x80). Kerberos on the wire uses DER, which mandates definite lengths; indefinite length (BER) would require end-of-contents scanning, so the decoder treats it as invalid input from a broken or malicious peer.

Solutions

1. Identify the sender producing BER-style indefinite lengths and fix its encoder to use definite lengths.
2. If data passed through a re-encoding proxy, disable or correct it.
3. Re-encode the blob with a DER-definite encoder before parsing.
4. Confirm the Kerberos library on the peer is configured for DER (asn1=DER).

When it happens

Trigger: Thrown at extra/kerberos/der.py:106 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of sqlmapproject/sqlmap@0a35b20e39 (2026-08-26). Data as JSON: /api/errors/36e7a4ee952e4696. Report an issue: GitHub.

Appendix: source

Thrown at extra/kerberos/der.py:106

def sequenceOf(elements):
    return _tlv(SEQUENCE, b"".join(bytes(_) for _ in elements))

# ---- decoding -------------------------------------------------------------------------------------
def peel(data, offset=0):
    """Parse one TLV at 'offset'; return (tag, content_bytearray, next_offset). Raises ValueError on
    truncated or indefinite-length input (the data may come from the network, so fail predictably)."""

    data = bytearray(data)
    if offset + 2 > len(data):
        raise ValueError("truncated DER header")
    tag = data[offset]
    first = data[offset + 1]
    offset += 2
    if first < 0x80:
        length = first
    elif first == 0x80:
        raise ValueError("indefinite-length DER is not permitted")
    else:
        count = first & 0x7f
        if offset + count > len(data):
            raise ValueError("truncated DER length")
        length = 0
        for _ in range(count):
            length = (length << 8) | data[offset]
            offset += 1
    if offset + length > len(data):
        raise ValueError("truncated DER content")
    return tag, data[offset:offset + length], offset + length

def children(content):
    """Iterate the TLVs contained in a constructed value; yields (tag, content_bytearray)."""

    content = bytearray(content)
    offset = 0
    out = []

View on GitHub (pinned to 0a35b20e39)