{"record":{"id":"aafbbb986fe3226e","repo":"shadow1ng/fscan","slug":"mssql-invalid-info-token-size","errorCode":null,"errorMessage":"mssql: invalid info token size","messagePattern":"mssql: invalid info token size","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"plugins/services/mssql_raw.go","lineNumber":360,"sourceCode":"\tpos += 2\n\tnumber := int32(binary.LittleEndian.Uint32(payload[pos : pos+4]))\n\tpos += 4\n\tpos += 2\n\tmessage, next, err := mssqlReadUSVarChar(payload, pos)\n\tif err != nil {\n\t\treturn mssqlRawError{}, pos, err\n\t}\n\treturn mssqlRawError{number: number, message: message}, end, mssqlEnsureSkipBVarStrings(payload, next, end)\n}\n\nfunc mssqlSkipUSVarError(payload []byte, pos int) (int, error) {\n\tif pos+2 > len(payload) {\n\t\treturn pos, fmt.Errorf(\"mssql: truncated info token\")\n\t}\n\tsize := int(binary.LittleEndian.Uint16(payload[pos : pos+2]))\n\tend := pos + 2 + size\n\tif size < 6 || end > len(payload) || pos+8 > len(payload) {\n\t\treturn pos, fmt.Errorf(\"mssql: invalid info token size\")\n\t}\n\t_, _, err := mssqlReadUSVarChar(payload, pos+8)\n\treturn end, err\n}\n\nfunc mssqlEnsureSkipBVarStrings(payload []byte, pos, end int) error {\n\tfor i := 0; i < 2; i++ {\n\t\tif pos >= end {\n\t\t\treturn fmt.Errorf(\"mssql: truncated string in error token\")\n\t\t}\n\t\tlength := int(payload[pos]) * 2\n\t\tpos++\n\t\tif pos+length > end {\n\t\t\treturn fmt.Errorf(\"mssql: invalid string in error token\")\n\t\t}\n\t\tpos += length\n\t}\n\tif pos+4 > end {","sourceCodeStart":342,"sourceCodeEnd":378,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/plugins/services/mssql_raw.go#L342-L378","documentation":"mssqlSkipUSVarError read an INFO token's 2-byte length and found the token structurally invalid: size below the 6-byte minimum, the token body extending past the payload, or the fixed header crossing the payload end. The library refuses to skip such a token because the declared framing contradicts the actual bytes available.","triggerScenarios":"mssqlParseLoginTokens encounters an INFO token where size < 6, or pos+2+size > len(payload), or pos+8 > len(payload).","commonSituations":"Malicious or fuzzed server sends an under-sized INFO token length to confuse parsers; corrupted reassembly by middleboxes; mixed TDS protocol versions where token layouts differ.","solutions":["Inspect the raw login response with a packet sniffer to see the malformed INFO token.","Remove or reconfigure any TDS-aware proxy between client and server.","Retry against the server directly (bypass proxies) to isolate the corruption source.","Harden the caller to abort the connection on this error instead of continuing to parse."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"size := int(binary.LittleEndian.Uint16(payload[pos : pos+2]))\nif size < 6 || pos+2+size > len(payload) || pos+8 > len(payload) {\n    return fmt.Errorf(\"INFO token framing invalid at offset %d\", pos)\n}","typeGuard":null,"tryCatchPattern":"next, err := mssqlSkipUSVarError(payload, pos)\nif err != nil {\n    conn.Close()\n    return fmt.Errorf(\"malformed INFO token from server: %w\", err)\n}","preventionTips":["Validate declared sizes against actual payload bounds before skipping.","Bypass suspicious proxies to isolate who corrupts the stream.","Abort the connection after framing violations; never continue parsing.","Record offending payloads for server-side bug reports."],"tags":["mssql","tds-protocol","malformed-packet","wire-parsing"],"backgroundTag":"unexpected-api-response-shape","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}