sqlmapproject/sqlmap · error · ValueError

truncated DER header

Error message

truncated DER header

What it means

peel in the minimal DER decoder raises this when fewer than 2 bytes remain at the given offset, so there is not even a complete tag+length header. Input may come straight from the network, so the decoder fails predictably with ValueError instead of indexing past the buffer.

Solutions

1. Check why the buffer is so short: truncated read, wrong offset, or parsing past the end of a message.
2. Verify the sender actually produced DER/BER Kerberos encoding.
3. Add length validation on the received message before parsing.
4. If parsing sub-fields, ensure the parent content offset/length is correct.

When it happens

Trigger: Thrown at extra/kerberos/der.py:99 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of sqlmapproject/sqlmap@0a35b20e39 (2026-08-26). Data as JSON: /api/errors/8e5a0838874112a4. Report an issue: GitHub.

Appendix: source

Thrown at extra/kerberos/der.py:99

    return _tlv(GENERALIZED_TIME, value if isinstance(value, bytes) else value.encode("ascii"))

def bitString(value, unusedBits=0):
    return _tlv(BIT_STRING, bytearray([unusedBits]) + bytearray(value))

def sequence(*elements):
    return _tlv(SEQUENCE, b"".join(bytes(_) for _ in elements))

def sequenceOf(elements):
    return _tlv(SEQUENCE, b"".join(bytes(_) for _ in elements))

# ---- decoding -------------------------------------------------------------------------------------
def peel(data, offset=0):
    """Parse one TLV at 'offset'; return (tag, content_bytearray, next_offset). Raises ValueError on
    truncated or indefinite-length input (the data may come from the network, so fail predictably)."""

    data = bytearray(data)
    if offset + 2 > len(data):
        raise ValueError("truncated DER header")
    tag = data[offset]
    first = data[offset + 1]
    offset += 2
    if first < 0x80:
        length = first
    elif first == 0x80:
        raise ValueError("indefinite-length DER is not permitted")
    else:
        count = first & 0x7f
        if offset + count > len(data):
            raise ValueError("truncated DER length")
        length = 0
        for _ in range(count):
            length = (length << 8) | data[offset]
            offset += 1
    if offset + length > len(data):
        raise ValueError("truncated DER content")
    return tag, data[offset:offset + length], offset + length

View on GitHub (pinned to 0a35b20e39)