{"record":{"id":"a121abd35f137f38","repo":"shadow1ng/fscan","slug":"readapplicationtag-invalid-data2","errorCode":null,"errorMessage":"ReadApplicationTag invalid data2","messagePattern":"ReadApplicationTag invalid data2","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"libs/grdp/protocol/t125/ber/ber.go","lineNumber":168,"sourceCode":"\t}\n\tWriteUniversalTag(TAG_BOOLEAN, false, w)\n\tWriteLength(1, w)\n\tcore.WriteUInt8(bb, w)\n}\n\nfunc ReadApplicationTag(tag uint8, r io.Reader) (int, error) {\n\tbb, _ := core.ReadUInt8(r)\n\tif tag > 30 {\n\t\tif bb != (CLASS_APPL|PC_CONSTRUCT)|TAG_MASK {\n\t\t\treturn 0, errors.New(\"ReadApplicationTag invalid data\")\n\t\t}\n\t\tbb, _ := core.ReadUInt8(r)\n\t\tif bb != tag {\n\t\t\treturn 0, errors.New(\"ReadApplicationTag bad tag\")\n\t\t}\n\t} else {\n\t\tif bb != (CLASS_APPL|PC_CONSTRUCT)|(TAG_MASK&tag) {\n\t\t\treturn 0, errors.New(\"ReadApplicationTag invalid data2\")\n\t\t}\n\t}\n\treturn ReadLength(r)\n}\n\nfunc WriteApplicationTag(tag uint8, size int, w io.Writer) {\n\tif tag > 30 {\n\t\tcore.WriteUInt8((CLASS_APPL|PC_CONSTRUCT)|TAG_MASK, w)\n\t\tcore.WriteUInt8(tag, w)\n\t\tWriteLength(size, w)\n\t} else {\n\t\tcore.WriteUInt8((CLASS_APPL|PC_CONSTRUCT)|(TAG_MASK&tag), w)\n\t\tWriteLength(size, w)\n\t}\n}\n\nfunc WriteEncodedDomainParams(data []byte, w io.Writer) {\n\tWriteUniversalTag(TAG_SEQUENCE, true, w)","sourceCodeStart":150,"sourceCodeEnd":186,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/libs/grdp/protocol/t125/ber/ber.go#L150-L186","documentation":"In the short tag form (tag <= 30), ReadApplicationTag requires the first byte to equal (CLASS_APPL|PC_CONSTRUCT)|(TAG_MASK&tag) — a single-byte application tag encoding the requested number. Any other byte means the field is not the expected application tag, producing this 'invalid data2' error.","triggerScenarios":"ReadConnectResponse calling ReadApplicationTag with tag <= 30 when the first byte is not the matching single-byte application tag — e.g. a long-form tag byte, a different class, or complete misalignment.","commonSituations":"Desynced streams where content bytes are read as tag bytes; servers using long-form encoding for small tags; non-RDP services on port 3389 returning arbitrary bytes.","solutions":["Hex-dump the stream at this offset and compare against the expected (CLASS_APPL|PC_CONSTRUCT)|tag byte","Check upstream parsers for off-by-one byte consumption causing misalignment","Verify the target service is RDP and the negotiation sequence completed correctly","If the server encodes small tags in long form, extend ReadApplicationTag to accept both encodings"],"exampleFix":"// before\nif bb != (CLASS_APPL|PC_CONSTRUCT)|(TAG_MASK&tag) {\n    return 0, errors.New(\"ReadApplicationTag invalid data2\")\n}\n\n// after\nif bb != (CLASS_APPL|PC_CONSTRUCT)|(TAG_MASK&tag) {\n    return 0, fmt.Errorf(\"ReadApplicationTag invalid data2: expected 0x%02X, got 0x%02X\", (CLASS_APPL|PC_CONSTRUCT)|(TAG_MASK&tag), bb)\n}","handlingStrategy":"validation","validationCode":"// pre-check the short-form application tag byte\nexpected := byte((ber.CLASS_APPL | ber.PC_CONSTRUCT) | (ber.TAG_MASK & tag))\nif buf[pos] != expected {\n    return fmt.Errorf(\"bad short-form application tag: got 0x%02X, want 0x%02X\", buf[pos], expected)\n}","typeGuard":null,"tryCatchPattern":"n, err := ber.ReadApplicationTag(tag, r)\nif err != nil {\n    if strings.Contains(err.Error(), \"invalid data2\") {\n        return fmt.Errorf(\"unexpected PDU where application tag %d expected: %w\", tag, err)\n    }\n    return err\n}","preventionTips":["Trace upstream byte consumption to catch desync before this check","Capture failing handshakes with Wireshark for byte-level comparison","Confirm negotiation flags keep the server on the standard T.125 response path"],"tags":["rdp","ber","asn1","tag-mismatch"],"backgroundTag":"invalid-argument-format","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}