{"record":{"id":"c87b673de509e11c","repo":"shadow1ng/fscan","slug":"oracle-server-compile-caps-too-short","errorCode":null,"errorMessage":"oracle server compile caps too short","messagePattern":"oracle server compile caps too short","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"plugins/services/oracle_raw.go","lineNumber":1034,"sourceCode":"\tserverNCharset := int(binary.BigEndian.Uint16(numArray[offset+3 : offset+5]))\n\tlen2, err := s.getByte()\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tcompileCaps, err := s.getBytes(int(len2))\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tlen3, err := s.getByte()\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\truntimeCaps, err := s.getBytes(int(len3))\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tif len(compileCaps) < 8 {\n\t\treturn nil, errors.New(\"oracle server compile caps too short\")\n\t}\n\tif len(compileCaps) > 15 && compileCaps[15]&1 != 0 {\n\t\ts.hasEOSCapability = true\n\t}\n\tif len(compileCaps) > 16 && compileCaps[16]&1 != 0 {\n\t\ts.hasFSAPCapability = true\n\t}\n\tif len(compileCaps) > 37 && compileCaps[37]&32 != 0 {\n\t\ts.useBigClrChunks = true\n\t\ts.clrChunkSize = 0x7fff\n\t}\n\treturn &oracleTCPNego{\n\t\tserverCharset:         serverCharset,\n\t\tserverFlags:           serverFlags | 2,\n\t\tserverNCharset:        serverNCharset,\n\t\tserverCompileTimeCaps: compileCaps,\n\t\tserverRuntimeCaps:     runtimeCaps,\n\t}, nil","sourceCodeStart":1016,"sourceCodeEnd":1052,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/plugins/services/oracle_raw.go#L1016-L1052","documentation":"The server reports its compiled-in capability flags in the compile-caps byte array. The library needs at least 8 bytes to safely interpret capability bits (EOS at index 15, FSAP at index 16 are optional and length-guarded). A shorter array means the server's capability data is malformed or the handshake is out of sync.","triggerScenarios":"protocolNegotiation() during oracleRawAuth reads runtimeCaps via getBytes(len3) and then finds len(compileCaps) < 8.","commonSituations":"Very old or non-standard Oracle server builds with minimal capability data; proxy mangling the negotiation frames; earlier length fields parsed incorrectly shifting the caps arrays.","solutions":["Verify against a standard Oracle server version the plugin is known to work with","Check whether earlier caps length fields (len2/len3) were read from the right offsets — fix any desync upstream","Test a direct connection bypassing proxies/firewalls that could truncate frames","Update plugin/server patch level; report with a wire capture if it persists"],"exampleFix":"// before\nif len(compileCaps) < 8 {\n\treturn nil, errors.New(\"oracle server compile caps too short\")\n}\n// after\nif len(compileCaps) < 8 {\n\treturn nil, fmt.Errorf(\"oracle server compile caps too short: got %d bytes\", len(compileCaps))\n}","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"if err != nil && strings.Contains(err.Error(), \"compile caps too short\") {\n\treturn fmt.Errorf(\"server capability data malformed or handshake desynced; verify server version and network path: %w\", err)\n}","preventionTips":["Use Oracle server versions the plugin is tested against","Bypass proxies when diagnosing negotiation failures","Fix any earlier field-length mis-parses that could shift the caps arrays"],"tags":["oracle","protocol","capabilities","negotiation"],"backgroundTag":"unexpected-response-shape","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}