{"record":{"id":"e528d17c3130254b","repo":"shadow1ng/fscan","slug":"wrong-size","errorCode":null,"errorMessage":"wrong size","messagePattern":"wrong size","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"libs/grdp/protocol/t125/ber/ber.go","lineNumber":122,"sourceCode":"\t\treturn 0, errors.New(\"Bad integer tag\")\n\t}\n\tsize, _ := ReadLength(r)\n\tswitch size {\n\tcase 1:\n\t\tnum, _ := core.ReadUInt8(r)\n\t\treturn int(num), nil\n\tcase 2:\n\t\tnum, _ := core.ReadUint16BE(r)\n\t\treturn int(num), nil\n\tcase 3:\n\t\tinteger1, _ := core.ReadUInt8(r)\n\t\tinteger2, _ := core.ReadUint16BE(r)\n\t\treturn int(integer2) + (int(integer1) << 16), nil\n\tcase 4:\n\t\tnum, _ := core.ReadUInt32BE(r)\n\t\treturn int(num), nil\n\tdefault:\n\t\treturn 0, errors.New(\"wrong size\")\n\t}\n}\n\nfunc WriteInteger(n int, w io.Writer) {\n\tWriteUniversalTag(TAG_INTEGER, false, w)\n\tif n <= 0xff {\n\t\tWriteLength(1, w)\n\t\tcore.WriteUInt8(uint8(n), w)\n\t} else if n <= 0xffff {\n\t\tWriteLength(2, w)\n\t\tcore.WriteUInt16BE(uint16(n), w)\n\t} else {\n\t\tWriteLength(4, w)\n\t\tcore.WriteUInt32BE(uint32(n), w)\n\t}\n}\n\nfunc WriteOctetstring(str string, w io.Writer) {","sourceCodeStart":104,"sourceCodeEnd":140,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/libs/grdp/protocol/t125/ber/ber.go#L104-L140","documentation":"ReadInteger supports only INTEGER content lengths of 1, 2, 3, or 4 bytes (mapping to uint8, uint16, 3-byte, uint32). Any other decoded length falls to the default branch and this error is returned. It means the integer field is encoded with an unexpected size.","triggerScenarios":"ReadDomainParameters or ReadConnectResponse reading an INTEGER whose BER length is 0 or >4 bytes — e.g. a 5+ byte integer or a zero-length integer.","commonSituations":"Desynced streams producing bogus length values; nonstandard encoders emitting 8-byte integers for large values; corrupted responses in transit.","solutions":["Inspect the captured bytes to see the actual length; confirm whether it is a genuine encoder difference or desync","Fix the upstream desync first — a bogus length here usually traces to earlier misparse","Extend the switch to handle the server's integer size (e.g. 8-byte via ReadUint64BE) if it is intentional","Retry if a transient network corruption is suspected"],"exampleFix":"// before\ndefault:\n    return 0, errors.New(\"wrong size\")\n\n// after\ndefault:\n    return 0, fmt.Errorf(\"wrong size: BER INTEGER length %d not in 1..4\", size)","handlingStrategy":"try-catch","validationCode":"// read the length yourself and reject impossible integer sizes early\nlength, _ := ber.ReadLength(r)\nif length == 0 || length > 4 {\n    return fmt.Errorf(\"unsupported INTEGER length %d\", length)\n}","typeGuard":null,"tryCatchPattern":"n, err := ber.ReadInteger(r)\nif err != nil {\n    if strings.Contains(err.Error(), \"wrong size\") {\n        // likely desync; log surrounding bytes and resync or abort\n    }\n    return err\n}","preventionTips":["Diff captured bytes against the T.125 layout when this fires","Fix upstream parsers first — bogus lengths usually originate earlier","Extend the size switch if a server legitimately uses 8-byte integers"],"tags":["rdp","ber","asn1","length-mismatch"],"backgroundTag":"unexpected-response-shape","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}