{"record":{"id":"752b5fd0bbccffbf","repo":"shadow1ng/fscan","slug":"message-length-too-large","errorCode":"message_length_too_large","errorMessage":"message_length_too_large: %d","messagePattern":"message_length_too_large: (.+?)","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"plugins/services/smb_protocol.go","lineNumber":706,"sourceCode":"\t\t\"0xc000006a\",\n\t\t\"0xc0000064\",\n\t\t\"0xc0000234\",\n\t}\n\n\treturn ClassifyError(err, smbAuthErrors, CommonNetworkErrors)\n}\n\n// readSMBMessage 从连接读取NetBIOS消息\nfunc readSMBMessage(conn net.Conn) ([]byte, error) {\n\theaderBuf := make([]byte, 4)\n\tif _, err := io.ReadFull(conn, headerBuf); err != nil {\n\t\treturn nil, err\n\t}\n\n\tmessageLength := int(headerBuf[0])<<24 | int(headerBuf[1])<<16 | int(headerBuf[2])<<8 | int(headerBuf[3])\n\n\tif messageLength > 1024*1024 {\n\t\treturn nil, fmt.Errorf(i18n.GetText(\"message_length_too_large\")+\": %d\", messageLength)\n\t}\n\n\tif messageLength == 0 {\n\t\treturn headerBuf, nil\n\t}\n\n\tmessageBuf := make([]byte, messageLength)\n\tif _, err := io.ReadFull(conn, messageBuf); err != nil {\n\t\treturn nil, err\n\t}\n\n\tresult := make([]byte, 0, 4+messageLength)\n\tresult = append(result, headerBuf...)\n\tresult = append(result, messageBuf...)\n\n\treturn result, nil\n}\n","sourceCodeStart":688,"sourceCodeEnd":724,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/plugins/services/smb_protocol.go#L688-L724","documentation":"readSMBMessage validates the 4-byte NetBIOS session header length field and rejects any message larger than 1 MiB with 'message_length_too_large'. This guards against malformed or hostile servers advertising absurd message sizes that would exhaust memory.","triggerScenarios":"Calling readSMBMessage (via probeTarget/probeSMBv1/probeSMBv2) against a server whose NetBIOS header declares a length over 1024*1024 bytes, or a non-SMB service returning garbage that parses as a huge length.","commonSituations":"Probing a port that is not actually SMB (e.g. a web or mail server), corrupted/garbled responses, deliberately malicious responses from honeypots, extremely large SMB responses from unusual servers.","solutions":["Verify the probed port actually speaks SMB (445/139); adjust probe port configuration.","Increase the 1 MiB limit in the plugin if the target legitimately sends large messages.","Add pre-filtering so non-SMB services are not probed as SMB.","Treat it as a signal the target is not an SMB server and skip it."],"exampleFix":"// before\nif messageLength > 1024*1024 {\n    return nil, fmt.Errorf(i18n.GetText(\"message_length_too_large\")+\": %d\", messageLength)\n}\n// after\nconst maxSMBMessageLen = 16 * 1024 * 1024 // allow larger legal SMB messages\nif messageLength > maxSMBMessageLen {\n    return nil, fmt.Errorf(i18n.GetText(\"message_length_too_large\")+\": %d\", messageLength)\n}","handlingStrategy":"validation","validationCode":"if len(banner) >= 4 {\n    l := int(banner[0])<<24 | int(banner[1])<<16 | int(banner[2])<<8 | int(banner[3])\n    if l > 1024*1024 { /* reject: not a sane SMB server */ }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Only probe ports known/likely to serve SMB","Treat oversized lengths as a sign the target is not SMB","Keep length limits to bound memory use","Log the advertised length for triage"],"tags":["smb","protocol","limit"],"backgroundTag":"payload-too-large","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}