What causes "mssql: invalid token size" in shadow1ng/fscan?

Retry the login and check whether the error reproduces deterministically.

mssql: invalid token size

Error message

mssql: invalid token size

What it means

mssqlSkipLen16 read a token's 2-byte length and computed the next token position, but pos+2+size exceeds the payload length — the token body claims more bytes than the response actually contains. The library throws 'invalid token size' rather than skipping into nonexistent bytes.

Solutions

Retry the login and check whether the error reproduces deterministically.
Packet-capture the response and validate the token's declared size against the actual byte count.
Check MTU/fragmentation issues or proxies that may drop trailing bytes.
Treat the response as corrupt: abort the connection instead of continuing to parse.

Defensive patterns

Strategy: validation

Validate before calling

size := int(binary.LittleEndian.Uint16(payload[pos : pos+2]))
if pos+2+size > len(payload) {
    return fmt.Errorf("token size %d overruns payload end %d", size, len(payload))
}

Try / catch

next, err := mssqlSkipLen16(payload, pos)
if err != nil {
    conn.Close()
    return fmt.Errorf("server response framing violated: %w", err)
}

Prevention

Validate every declared length against remaining payload bytes.
Check MTU/fragmentation handling in your TCP read loop.
Isolate whether a middlebox is splicing TCP segments incorrectly.
Abort parsing after any overrun; token stream integrity is broken.

When it happens

Trigger: A length-prefixed token in the login response declares a size that overruns the end of the payload (pos+2+size > len(payload)).

Common situations: Truncated TCP stream with a corrupted trailing length; fuzzer or hostile server inflating the length field to trigger over-reads; middlebox splicing segments incorrectly.

Understand the failure class

Background: "invalid response format", "malformed payload", "missing data field": when an API returns 200 but the response shape is wrong — this error's family across 23 libraries.

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/1826192e0d4308f7. Report an issue: GitHub.

Appendix: source

Thrown at plugins/services/mssql_raw.go:391

		if pos+length > end {
			return fmt.Errorf("mssql: invalid string in error token")
		}
		pos += length
	}
	if pos+4 > end {
		return fmt.Errorf("mssql: truncated error line number")
	}
	return nil
}

func mssqlSkipLen16(payload []byte, pos int) (int, error) {
	if pos+2 > len(payload) {
		return pos, fmt.Errorf("mssql: truncated token")
	}
	size := int(binary.LittleEndian.Uint16(payload[pos : pos+2]))
	next := pos + 2 + size
	if next > len(payload) {
		return pos, fmt.Errorf("mssql: invalid token size")
	}
	return next, nil
}

func mssqlReadUSVarChar(payload []byte, pos int) (string, int, error) {
	if pos+2 > len(payload) {
		return "", pos, fmt.Errorf("mssql: truncated us varchar")
	}
	chars := int(binary.LittleEndian.Uint16(payload[pos : pos+2]))
	pos += 2
	size := chars * 2
	if pos+size > len(payload) {
		return "", pos, fmt.Errorf("mssql: invalid us varchar size")
	}
	return mssqlDecodeUCS2(payload[pos : pos+size]), pos + size, nil
}

func mssqlWritePacket(w io.Writer, packetType byte, payload []byte) error {

View on GitHub (pinned to 95cc12e753)