{"record":{"id":"616c779310021846","repo":"shadow1ng/fscan","slug":"capability-length-expected-d","errorCode":null,"errorMessage":"Capability length expected %d","messagePattern":"Capability length expected (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"libs/grdp/protocol/pdu/caps.go","lineNumber":686,"sourceCode":"\tCacheSize    uint16 `struc:\"little\"`\n\tCacheEntries uint16 `struc:\"little\"`\n}\n\nfunc (*DrawNineGridCapability) Type() CapsType {\n\treturn CAPSTYPE_DRAWNINEGRIDCACHE\n}\n\nfunc readCapability(r io.Reader) (Capability, error) {\n\tcapType, err := core.ReadUint16LE(r)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tcapLen, err := core.ReadUint16LE(r)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tif int(capLen)-4 <= 0 {\n\t\treturn nil, errors.New(fmt.Sprintf(\"Capability length expected %d\", capLen))\n\t}\n\n\tcapBytes, err := core.ReadBytes(int(capLen)-4, r)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tcapReader := bytes.NewReader(capBytes)\n\tvar c Capability\n\tglog.Debugf(\"Capability type 0x%04x\", capType)\n\tswitch CapsType(capType) {\n\tcase CAPSTYPE_GENERAL:\n\t\tc = &GeneralCapability{}\n\tcase CAPSTYPE_BITMAP:\n\t\tc = &BitmapCapability{}\n\tcase CAPSTYPE_ORDER:\n\t\tc = &OrderCapability{}\n\tcase CAPSTYPE_BITMAPCACHE:\n\t\tc = &BitmapCacheCapability{}","sourceCodeStart":668,"sourceCodeEnd":704,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/libs/grdp/protocol/pdu/caps.go#L668-L704","documentation":"Protocol validation in readCapability (RDP PDU capability parsing): the capability-set length field read from the server is <= 4, meaning there is no payload after the type and length header — a malformed or truncated capability set from the server.","triggerScenarios":"Thrown at libs/grdp/protocol/pdu/caps.go:686 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Treat the peer as speaking a broken/nonstandard RDP and skip further negotiation","Verify the service is actually RDP and not a protocol-smart honeypot","Capture the raw packet to identify where the capability stream got truncated"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}