{"record":{"id":"864fa9d601b2e6a1","repo":"shadow1ng/fscan","slug":"invalid-expected-ber-tag","errorCode":null,"errorMessage":"invalid expected BER tag","messagePattern":"invalid expected BER tag","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"libs/grdp/protocol/t125/mcs.go","lineNumber":199,"sourceCode":"func ReadConnectResponse(r io.Reader) (*ConnectResponse, error) {\n\tc := &ConnectResponse{}\n\tvar err error\n\t_, err = ber.ReadApplicationTag(MCS_TYPE_CONNECT_RESPONSE, r)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tc.result, err = ber.ReadEnumerated(r)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tc.calledConnectId, err = ber.ReadInteger(r)\n\tc.domainParameters, err = ReadDomainParameters(r)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tif !ber.ReadUniversalTag(ber.TAG_OCTET_STRING, false, r) {\n\t\treturn nil, errors.New(\"invalid expected BER tag\")\n\t}\n\tdataLen, _ := ber.ReadLength(r)\n\tc.userData, err = core.ReadBytes(dataLen, r)\n\treturn c, err\n}\n\ntype MCSChannelInfo struct {\n\tID   uint16\n\tName string\n}\n\ntype MCS struct {\n\temission.Emitter\n\ttransport  core.Transport\n\trecvOpCode MCSDomainPDU\n\tsendOpCode MCSDomainPDU\n\tchannels   []MCSChannelInfo\n}","sourceCodeStart":181,"sourceCodeEnd":217,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/libs/grdp/protocol/t125/mcs.go#L181-L217","documentation":"ReadConnectResponse, after parsing result, calledConnectId and DomainParameters, expects a BER OCTET STRING universal tag holding the userData (GCC blocks). If ReadUniversalTag(TAG_OCTET_STRING, constructed=false) fails, the tail of the MCS Connect Response is not the expected octet string. The response is malformed or truncated at that point.","triggerScenarios":"Parsing a server MCS Connect Response where, after DomainParameters, the next byte is not a primitive OCTET STRING tag (0x04) — e.g. the response was truncated, contains a different encoding, or the reader was already misaligned.","commonSituations":"Server sends a Connect Response with an empty or differently encoded userData section; TCP fragmentation/partial reads deliver an incomplete buffer to ReadConnectResponse; non-RDP service on the port; earlier BER parse consumed wrong lengths shifting the tag position.","solutions":["Log the hex dump of the full response and verify the expected tag byte 0x04 at that offset.","Ensure the transport delivers the complete MCS Connect Response (length-prefixed) before invoking recvConnectResponse.","Check the DomainParameters parse consumed exactly the encoded length (ReadLength result is discarded in ReadDomainParameters — a mismatch desynchronizes parsing).","Include the actual byte value in the error for faster diagnosis."],"exampleFix":"// before\nif !ber.ReadUniversalTag(ber.TAG_OCTET_STRING, false, r) {\n    return nil, errors.New(\"invalid expected BER tag\")\n}\n// after\nif !ber.ReadUniversalTag(ber.TAG_OCTET_STRING, false, r) {\n    return nil, fmt.Errorf(\"invalid expected BER tag: want OCTET_STRING(0x04)\")\n}","handlingStrategy":"try-catch","validationCode":"// After DomainParameters, verify the next tag is a primitive OCTET STRING:\nif len(buf) > 0 && buf[pos] != 0x04 {\n    return errors.New(\"Connect Response userData tag is not OCTET STRING\")\n}","typeGuard":null,"tryCatchPattern":"mcs.On(\"error\", func(err error) {\n    if strings.Contains(err.Error(), \"invalid expected BER tag\") {\n        // response malformed/truncated — reconnect or inspect raw dump\n    }\n})","preventionTips":["Ensure the transport buffers the complete MCS Connect Response before dispatching 'data'.","Fix discarded ReadLength results in ReadDomainParameters to prevent reader desync.","Test against known-good RDP servers when changing parsing code."],"tags":["rdp","ber","protocol-parsing","mcs"],"backgroundTag":"unexpected-response-shape","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}