What causes "mssql: invalid string in error token" in shadow1ng/fscan?

Hex-dump the offending packet and compare the string length byte against the token size.

mssql: invalid string in error token

Error message

mssql: invalid string in error token

What it means

While skipping the BVarChar strings in an ERROR token, mssqlEnsureSkipBVarStrings read a 1-byte character count whose doubled byte-length extends beyond the token end (pos+length > end). The declared string does not fit inside the token, so the library throws instead of reading out of bounds.

Source

Thrown at plugins/services/mssql_raw.go:374

	}
	size := int(binary.LittleEndian.Uint16(payload[pos : pos+2]))
	end := pos + 2 + size
	if size < 6 || end > len(payload) || pos+8 > len(payload) {
		return pos, fmt.Errorf("mssql: invalid info token size")
	}
	_, _, err := mssqlReadUSVarChar(payload, pos+8)
	return end, err
}

func mssqlEnsureSkipBVarStrings(payload []byte, pos, end int) error {
	for i := 0; i < 2; i++ {
		if pos >= end {
			return fmt.Errorf("mssql: truncated string in error token")
		}
		length := int(payload[pos]) * 2
		pos++
		if pos+length > end {
			return fmt.Errorf("mssql: invalid string in error token")
		}
		pos += length
	}
	if pos+4 > end {
		return fmt.Errorf("mssql: truncated error line number")
	}
	return nil
}

func mssqlSkipLen16(payload []byte, pos int) (int, error) {
	if pos+2 > len(payload) {
		return pos, fmt.Errorf("mssql: truncated token")
	}
	size := int(binary.LittleEndian.Uint16(payload[pos : pos+2]))
	next := pos + 2 + size
	if next > len(payload) {
		return pos, fmt.Errorf("mssql: invalid token size")
	}

View on GitHub (pinned to 95cc12e753)

Solutions

Hex-dump the offending packet and compare the string length byte against the token size.
Retry the connection to rule out transient corruption.
Bypass or update any proxy/TLS terminator that may be rewriting payload bytes.
Abort parsing this response; never trust the remaining token stream after a framing violation.

Defensive patterns

Strategy: validation

Validate before calling

length := int(payload[pos]) * 2
if pos+1+length > end {
    return fmt.Errorf("BVarChar length %d exceeds token end %d", length, end)
}

Try / catch

if err := mssqlEnsureSkipBVarStrings(payload, pos, end); err != nil {
    conn.Close()
    return fmt.Errorf("ERROR token string out of bounds: %w", err)
}

Prevention

Never trust length bytes; always check pos+length <= end before advancing.
Use TLS to prevent in-transit byte corruption of string lengths.
Add structured fuzz tests with inflated BVarChar lengths.
Pin the negotiated TDS version so token layouts stay consistent.

When it happens

Trigger: An ERROR token's BVarChar length byte claims a string larger than the remaining bytes between pos and the token end.

Common situations: Fuzzed or hostile server sends an inflated length byte; byte corruption in transit (e.g. a proxy mangling UTF-16 strings); TDS protocol mismatch producing misaligned length fields.

Understand the failure class

Background: "invalid response format", "malformed payload", "missing data field": when an API returns 200 but the response shape is wrong — this error's family across 23 libraries.

Related errors

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/f131d00e807767f9. Report an issue: GitHub.