| Previous | Next |
| CRYPT_E_ASN1_EXTENDED | CERTSRV_E_BAD_REQUESTSUBJECT |
CRYPT_E_ASN1_NOEOD
A complete object is followed by unexpected bytes
CRYPT_E_ASN1_NOEOD is the converse of an unexpected end-of-data error. The requested ASN.1 value was decoded, but the containing buffer or nested element still has bytes remaining where the decoder expected the end of the object.
Trailing data can come from concatenated DER objects, a length that describes the wrong slice, an unremoved transport header, or an application that passes an entire container to a decoder expecting only one inner value. Ignoring the suffix is dangerous because it can create parser differentials between components that authenticate different byte ranges.
How to resolve it
- Compare consumed bytes with the exact input length.
- Use the outer container decoder before decoding an embedded certificate or extension.
- Split concatenated objects using their DER lengths rather than delimiter searches.
- Reject unexplained trailing bytes in signed or security-sensitive inputs.
References
- ITU-T X.690: definite lengths and complete values
- Microsoft: CryptDecodeObjectEx input length
- RFC 5280: DER certificate encoding
Looking for a different code? Search another status or error code.