{"record":{"id":"e07545922c6d1541","repo":"shadow1ng/fscan","slug":"readapplicationtag-invalid-data","errorCode":null,"errorMessage":"ReadApplicationTag invalid data","messagePattern":"ReadApplicationTag invalid data","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"libs/grdp/protocol/t125/ber/ber.go","lineNumber":160,"sourceCode":"\tWriteLength(len(str), w)\n\tcore.WriteBytes([]byte(str), w)\n}\n\nfunc WriteBoolean(b bool, w io.Writer) {\n\tbb := uint8(0)\n\tif b {\n\t\tbb = uint8(0xff)\n\t}\n\tWriteUniversalTag(TAG_BOOLEAN, false, w)\n\tWriteLength(1, w)\n\tcore.WriteUInt8(bb, w)\n}\n\nfunc ReadApplicationTag(tag uint8, r io.Reader) (int, error) {\n\tbb, _ := core.ReadUInt8(r)\n\tif tag > 30 {\n\t\tif bb != (CLASS_APPL|PC_CONSTRUCT)|TAG_MASK {\n\t\t\treturn 0, errors.New(\"ReadApplicationTag invalid data\")\n\t\t}\n\t\tbb, _ := core.ReadUInt8(r)\n\t\tif bb != tag {\n\t\t\treturn 0, errors.New(\"ReadApplicationTag bad tag\")\n\t\t}\n\t} else {\n\t\tif bb != (CLASS_APPL|PC_CONSTRUCT)|(TAG_MASK&tag) {\n\t\t\treturn 0, errors.New(\"ReadApplicationTag invalid data2\")\n\t\t}\n\t}\n\treturn ReadLength(r)\n}\n\nfunc WriteApplicationTag(tag uint8, size int, w io.Writer) {\n\tif tag > 30 {\n\t\tcore.WriteUInt8((CLASS_APPL|PC_CONSTRUCT)|TAG_MASK, w)\n\t\tcore.WriteUInt8(tag, w)\n\t\tWriteLength(size, w)","sourceCodeStart":142,"sourceCodeEnd":178,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/libs/grdp/protocol/t125/ber/ber.go#L142-L178","documentation":"ReadApplicationTag parses a BER application-class tag. When the requested tag number exceeds 30 it needs the multi-byte long tag form, so the first byte must equal (CLASS_APPL|PC_CONSTRUCT)|TAG_MASK (0x6F). Any other byte means the data is not a valid high-numbered application tag.","triggerScenarios":"ReadConnectResponse calling ReadApplicationTag with tag > 30 (e.g. tag 101 for the T.125 CONNECT_RESPONSE) when the first stream byte is not 0x6F — the field is misaligned or absent.","commonSituations":"Non-RDP services answering on 3389; desync from mismatched X.224 negotiation; TLS interception or proxy altering the response bytes; servers answering with an error PDU instead of CONNECT_RESPONSE where the application tag is expected.","solutions":["Capture and hex-dump the CONNECT_RESPONSE; check the first byte of the application tag field against 0x6F","Confirm the target is a genuine RDP server and the port is not answered by another service","Trace upstream parsing to find where the byte alignment went wrong and fix that parser","Check whether the server sent a negotiation failure PDU instead of the expected response"],"exampleFix":"// before\nif bb != (CLASS_APPL|PC_CONSTRUCT)|TAG_MASK {\n    return 0, errors.New(\"ReadApplicationTag invalid data\")\n}\n\n// after\nif bb != (CLASS_APPL|PC_CONSTRUCT)|TAG_MASK {\n    return 0, fmt.Errorf(\"ReadApplicationTag invalid data: expected 0x6F, got 0x%02X\", bb)\n}","handlingStrategy":"validation","validationCode":"// verify the application tag byte before calling ReadApplicationTag\nexpected := byte((ber.CLASS_APPL | ber.PC_CONSTRUCT) | ber.TAG_MASK)\nif buf[pos] != expected {\n    return fmt.Errorf(\"no long-form application tag at offset %d: got 0x%02X, want 0x%02X\", pos, buf[pos], expected)\n}","typeGuard":null,"tryCatchPattern":"n, err := ber.ReadApplicationTag(101, r)\nif err != nil {\n    if strings.Contains(err.Error(), \"invalid data\") {\n        return fmt.Errorf(\"response is not the expected T.125 CONNECT_RESPONSE: %w\", err)\n    }\n    return err\n}","preventionTips":["Check the server's negotiation result byte before parsing CONNECT_RESPONSE","Hex-dump responses on failure to spot misalignment immediately","Confirm port 3389 is answered by an RDP server, not a proxy or other service"],"tags":["rdp","ber","asn1","tag-mismatch"],"backgroundTag":"invalid-argument-format","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}