{"record":{"id":"a4287cf0346be69b","repo":"shadow1ng/fscan","slug":"bad-integer-tag","errorCode":null,"errorMessage":"Bad integer tag","messagePattern":"Bad integer tag","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"libs/grdp/protocol/t125/ber/ber.go","lineNumber":104,"sourceCode":"\t\t}\n\t} else {\n\t\tret = int(size)\n\t}\n\treturn ret, nil\n}\n\nfunc WriteLength(size int, w io.Writer) {\n\tif size > 0x7f {\n\t\tcore.WriteUInt8(0x82, w)\n\t\tcore.WriteUInt16BE(uint16(size), w)\n\t} else {\n\t\tcore.WriteUInt8(uint8(size), w)\n\t}\n}\n\nfunc ReadInteger(r io.Reader) (int, error) {\n\tif !ReadUniversalTag(TAG_INTEGER, false, r) {\n\t\treturn 0, errors.New(\"Bad integer tag\")\n\t}\n\tsize, _ := ReadLength(r)\n\tswitch size {\n\tcase 1:\n\t\tnum, _ := core.ReadUInt8(r)\n\t\treturn int(num), nil\n\tcase 2:\n\t\tnum, _ := core.ReadUint16BE(r)\n\t\treturn int(num), nil\n\tcase 3:\n\t\tinteger1, _ := core.ReadUInt8(r)\n\t\tinteger2, _ := core.ReadUint16BE(r)\n\t\treturn int(integer2) + (int(integer1) << 16), nil\n\tcase 4:\n\t\tnum, _ := core.ReadUInt32BE(r)\n\t\treturn int(num), nil\n\tdefault:\n\t\treturn 0, errors.New(\"wrong size\")","sourceCodeStart":86,"sourceCodeEnd":122,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/libs/grdp/protocol/t125/ber/ber.go#L86-L122","documentation":"ReadInteger parses a BER INTEGER. It first validates the universal tag byte equals TAG_INTEGER; a mismatch means the stream does not contain an integer where one is expected, so this error is returned. This typically indicates a malformed or misaligned CONNECT_RESPONSE or domain parameters blob.","triggerScenarios":"ReadDomainParameters or ReadConnectResponse calling ReadInteger when the byte at the integer field position is not the TAG_INTEGER universal tag.","commonSituations":"Connecting to a service that is not RDP; protocol desync from mismatched negotiation flags shifting field boundaries; proxies or middleboxes altering the byte stream.","solutions":["Capture the raw X.224/T.125 exchange in Wireshark and compare the CONNECT_RESPONSE layout to the T.125 spec","Verify earlier fields parsed the correct byte counts — a desync upstream makes this tag read garbage","Confirm the target host/port actually runs an RDP server","Update grdp; server encoder variants may place fields differently than this parser assumes"],"exampleFix":"// before\nif !ReadUniversalTag(TAG_INTEGER, false, r) {\n    return 0, errors.New(\"Bad integer tag\")\n}\n\n// after\nif !ReadUniversalTag(TAG_INTEGER, false, r) {\n    return 0, fmt.Errorf(\"Bad integer tag: expected INTEGER (0x02), got 0x%02X\", lastReadByte)\n}","handlingStrategy":"validation","validationCode":"// confirm the byte is an INTEGER tag before calling ReadInteger\nif buf[pos] != 0x02 {\n    return fmt.Errorf(\"not an INTEGER tag at offset %d: 0x%02X\", pos, buf[pos])\n}","typeGuard":null,"tryCatchPattern":"n, err := ber.ReadInteger(r)\nif err != nil {\n    if strings.Contains(err.Error(), \"Bad integer tag\") {\n        // stream is not a well-formed T.125 response; abort handshake cleanly\n        return ErrNotRdpServer\n    }\n    return err\n}","preventionTips":["Probe the endpoint for RDP support before the handshake","Keep byte-level debug logging of negotiation to spot desyncs","Match X.224 negotiation flags to the server to keep the response well-formed"],"tags":["rdp","ber","asn1","protocol-parsing"],"backgroundTag":"invalid-argument-format","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}