| Previous | Next |
| CRYPT_E_ASN1_CORRUPT | CRYPT_E_ASN1_CONSTRAINT |
CRYPT_E_ASN1_LARGE
The value is valid in shape but too large to represent
CRYPT_E_ASN1_LARGE indicates that the decoder encountered an ASN.1 value whose encoded length or numeric magnitude cannot fit the implementation's supported representation. This is not the same as an output buffer being too small: the object itself exceeds an architectural or schema limit.
Oversized integer encodings, extreme length-of-length values, and attacker-controlled counts can trigger this result before any certificate semantics are evaluated. DER also requires minimal encodings, so redundant leading octets can be both non-canonical and capable of pushing a value over a decoder limit.
What to inspect
- Read the tag and length octets at the failing offset.
- Check count and size fields before allocating memory from untrusted input.
- Reject non-minimal INTEGER and length encodings rather than trimming them silently.
- Compare the value with the limits of the destination CryptoAPI structure.
References
- ITU-T X.690: length and INTEGER encoding rules
- Microsoft: CryptDecodeObjectEx allocation behavior
- RFC 5280: constrained X.509 certificate fields
Looking for a different code? Search another status or error code.