{"record":{"id":"07d45b3bab1f3deb","repo":"shadow1ng/fscan","slug":"mssql-truncated-done-token","errorCode":null,"errorMessage":"mssql: truncated done token","messagePattern":"mssql: truncated done token","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"plugins/services/mssql_raw.go","lineNumber":322,"sourceCode":"\t\t\t\treturn false, err\n\t\t\t}\n\t\t\tpos = next\n\t\tcase tdsTokenEnvChange:\n\t\t\tnext, err := mssqlSkipLen16(payload, pos)\n\t\t\tif err != nil {\n\t\t\t\treturn false, err\n\t\t\t}\n\t\t\tpos = next\n\t\tcase tdsTokenLoginAck:\n\t\t\tnext, err := mssqlSkipLen16(payload, pos)\n\t\t\tif err != nil {\n\t\t\t\treturn false, err\n\t\t\t}\n\t\t\tresult.sawLoginAck = true\n\t\t\tpos = next\n\t\tcase tdsTokenDone, tdsTokenDoneProc, tdsTokenDoneInProc:\n\t\t\tif pos+12 > len(payload) {\n\t\t\t\treturn false, fmt.Errorf(\"mssql: truncated done token\")\n\t\t\t}\n\t\t\tstatus := binary.LittleEndian.Uint16(payload[pos : pos+2])\n\t\t\treturn status&(tdsDoneError|tdsDoneSrvError) == 0, nil\n\t\tdefault:\n\t\t\treturn false, fmt.Errorf(\"mssql: unexpected login token 0x%02x\", token)\n\t\t}\n\t}\n\treturn false, nil\n}\n\nfunc mssqlParseErrorToken(payload []byte, pos int) (mssqlRawError, int, error) {\n\tif pos+2 > len(payload) {\n\t\treturn mssqlRawError{}, pos, fmt.Errorf(\"mssql: truncated error token\")\n\t}\n\tsize := int(binary.LittleEndian.Uint16(payload[pos : pos+2]))\n\tend := pos + 2 + size\n\tif size < 6 || end > len(payload) || pos+8 > len(payload) {\n\t\treturn mssqlRawError{}, pos, fmt.Errorf(\"mssql: invalid error token size\")","sourceCodeStart":304,"sourceCodeEnd":340,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/plugins/services/mssql_raw.go#L304-L340","documentation":"Guard in mssqlParseLoginTokens while walking a TDS DONE/DONEPROC/DONEINPROC token: the remaining payload is shorter than the 12 bytes a done token requires (pos+12 exceeds the buffer). The truncated login response cannot be scored for success/error status bits.","triggerScenarios":"mssqlParseLoginTokens hits token 0xFD/0xFE/0xFF with pos+12 > len(payload) — the login response payload ended mid-Done-token.","commonSituations":"Truncated login responses due to network resets or proxies; server that aborted the connection while writing the final token; fuzzed/invalid TDS streams.","solutions":["Retry the login to rule out a transient truncation.","Capture packets to determine whether the server closed early (TCP FIN/RST mid-token).","Check for middleboxes limiting response size or idle-timeout kills.","If persistent, test the same server with go-mssqldb to see whether a full driver also fails."],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":["Retry once on truncation errors — often transient network resets.","Watch for TCP FIN/RST immediately after login in captures to find the closer.","Increase server-side packet/response limits if payloads are large."],"tags":["mssql","tds","login","malformed-data"],"backgroundTag":"invalid-argument-format","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}