{"record":{"id":"1062baa2f833fb5e","repo":"shadow1ng/fscan","slug":"smb1-response-too-short-d-bytes","errorCode":null,"errorMessage":"SMB1 response too short: %d bytes","messagePattern":"SMB1 response too short: (.+?) bytes","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"plugins/services/ms17010_exp.go","lineNumber":203,"sourceCode":"func smb1GetResponse(conn net.Conn) ([]byte, *smbHeader, error) {\n\t// net BIOS\n\tbuf := make([]byte, 4)\n\t_, err := io.ReadFull(conn, buf)\n\tif err != nil {\n\t\tconst format = \"failed to get SMB1 response about NetBIOS session service: %s\"\n\t\treturn nil, nil, fmt.Errorf(format, err)\n\t}\n\ttyp := buf[0]\n\tif typ != 0x00 {\n\t\tconst format = \"invalid message type 0x%02X in SMB1 response\"\n\t\treturn nil, nil, fmt.Errorf(format, typ)\n\t}\n\tsizeBuf := make([]byte, 4)\n\tcopy(sizeBuf[1:], buf[1:])\n\tsize := int(binary.BigEndian.Uint32(sizeBuf))\n\t// 畸形响应（size < SMB 头长度）会导致后续 buf[:smbHeaderSize] 越界 panic\n\tif size < smbHeaderSize {\n\t\treturn nil, nil, fmt.Errorf(\"SMB1 response too short: %d bytes\", size)\n\t}\n\t// SMB\n\tbuf = make([]byte, size)\n\t_, err = io.ReadFull(conn, buf)\n\tif err != nil {\n\t\tconst format = \"failed to get SMB1 response about header: %s\"\n\t\treturn nil, nil, fmt.Errorf(format, err)\n\t}\n\tsmbHeader := smbHeader{}\n\treader := bytes.NewReader(buf[:smbHeaderSize])\n\terr = binary.Read(reader, binary.LittleEndian, &smbHeader)\n\tif err != nil {\n\t\tconst format = \"failed to parse SMB1 response header: %s\"\n\t\treturn nil, nil, fmt.Errorf(format, err)\n\t}\n\treturn buf, &smbHeader, nil\n}\n","sourceCodeStart":185,"sourceCodeEnd":221,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/plugins/services/ms17010_exp.go#L185-L221","documentation":"This error is returned by smb1GetResponse when the length field of the NetBIOS header decodes to a value smaller than the 32-byte SMB header (smbHeaderSize) (plugins/services/ms17010_exp.go:203). Such a frame cannot contain a valid SMB message, and proceeding would cause an out-of-range slice when parsing buf[:smbHeaderSize]. The library throws it as a guard against malformed/hostile responses.","triggerScenarios":"The 3-byte NetBIOS length yields size < 32 — a truncated, corrupt, or deliberately crafted response from the peer, or reading from a desynchronized stream where arbitrary bytes form a tiny length.","commonSituations":"Honeypots or fuzzers sending junk frames; responses from non-SMB protocols that happen to start with 0x00; partially flushed responses captured mid-write; scanning misbehaving embedded devices.","solutions":["Treat the target as speaking broken/non-SMB protocol and skip it or flag for manual inspection","Reconnect and retry once — a desynced stream is unrecoverable but a fresh one may work","Log the declared size alongside the raw 4 NetBIOS bytes to diagnose the offending responder","Keep the guard in place: never remove the size check, it prevents a slice-bounds panic"],"exampleFix":"// before\nif size < smbHeaderSize {\n    return nil, nil, fmt.Errorf(\"SMB1 response too short: %d bytes\", size)\n}\n// after\nif size < smbHeaderSize {\n    return nil, nil, fmt.Errorf(\"SMB1 response too short: %d bytes (NetBIOS header: % x)\", size, buf)\n}","handlingStrategy":"validation","validationCode":"// Callers can pre-validate framing assumptions only by reading; guard downstream instead\nfunc safeParseSMBResponse(raw []byte) (*smbHeader, bool) {\n    if len(raw) < smbHeaderSize { return nil, false }\n    h := &smbHeader{}\n    if err := binary.Read(bytes.NewReader(raw[:smbHeaderSize]), binary.LittleEndian, h); err != nil {\n        return nil, false\n    }\n    return h, true\n}","typeGuard":"func isMalformedFrameErr(err error) bool {\n    return strings.Contains(err.Error(), \"SMB1 response too short\")\n}","tryCatchPattern":"_, _, err := smb1GetResponse(conn)\nif err != nil {\n    if isMalformedFrameErr(err) {\n        return markHostSuspicious() // broken or hostile SMB responder\n    }\n    return err\n}","preventionTips":["Keep the size >= smbHeaderSize check — removing it reintroduces a slice-bounds panic on hostile responses","Treat repeated tiny-length frames from one host as evidence of a non-SMB or malicious responder","Log the raw 4 NetBIOS bytes with the error for post-scan triage","Skip (do not retry) hosts returning malformed frames; a fresh connection rarely helps"],"tags":["smb","validation","malformed-response","netbios","bounds-check"],"backgroundTag":"schema-validation-failed","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}