shadow1ng/fscan · error

mssql: invalid prelogin option bounds

Error message

mssql: invalid prelogin option bounds

What it means

A prelogin option entry declared an offset/length pair whose value range falls outside the payload (offset+length > len(payload) or negative values). The option table points to data that is not present in the packet.

Source

Thrown at plugins/services/mssql_raw.go:186

}

func mssqlParsePreloginFields(payload []byte) (map[byte][]byte, error) {
	fields := make(map[byte][]byte)
	for pos := 0; ; pos += 5 {
		if pos >= len(payload) {
			return nil, fmt.Errorf("mssql: invalid prelogin option table")
		}
		token := payload[pos]
		if token == tdsPreloginTerminator {
			return fields, nil
		}
		if pos+5 > len(payload) {
			return nil, fmt.Errorf("mssql: truncated prelogin option")
		}
		offset := int(binary.BigEndian.Uint16(payload[pos+1 : pos+3]))
		length := int(binary.BigEndian.Uint16(payload[pos+3 : pos+5]))
		if offset < 0 || length < 0 || offset+length > len(payload) {
			return nil, fmt.Errorf("mssql: invalid prelogin option bounds")
		}
		fields[token] = payload[offset : offset+length]
	}
}

func mssqlSendLogin7(w io.Writer, host, username, password string) error {
	values := []struct {
		text     string
		password bool
	}{
		{"", false},
		{username, false},
		{password, true},
		{"", false},
		{"", false},
		{"", false},
		{"", false},
		{"master", false},

View on GitHub (pinned to 95cc12e753)

Solutions

1. Verify packet integrity end-to-end with a capture; retransmit if corruption is transient.
2. Check any TDS proxy/gateway for offset-rewriting bugs.
3. Harden the client by logging offset, length, and payload size when this fires.
4. Confirm the endpoint is genuine SQL Server; arbitrary services can send arbitrary garbage.

_, err := mssqlRawLogin(ctx, host, port, user, pass, timeout)
if err != nil && strings.Contains(err.Error(), "invalid prelogin option bounds") {
    // offsets point outside payload: corrupt/malicious peer; mark endpoint untrusted
}

When it happens

Trigger: mssqlParsePreloginFields reads a 5-byte entry whose decoded offset/length exceed the payload bounds when slicing payload[offset:offset+length].

Common situations: Corrupted packets in transit; malicious or buggy TDS endpoints; a proxy that rewrites payload length but not the option table offsets.

Understand the failure class

Background: "value must be between 0 and 1" / "out of range" / "must not be negative" errors: fixing range-validation failures across open-source libraries — this error's family across 42 libraries.

Related errors

• mssql: invalid prelogin option table
• mssql: truncated prelogin option
• mssql: invalid prelogin response packet type %d
• mssql: empty prelogin response
• mssql: prelogin response missing encryption field

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/8eba2fdcd18e8cd6. Report an issue: GitHub.