Skip to content

Fix high-byte decoding of RDP TPKT lengths - #858

Open
darkdi wants to merge 1 commit into
robertdavidgraham:masterfrom
darkdi:fix/rdp-tpkt-length
Open

darkdi wants to merge 1 commit into
robertdavidgraham:masterfrom
darkdi:fix/rdp-tpkt-length

Conversation

@darkdi

@darkdi darkdi commented Oct 11, 2026

Copy link
Copy Markdown
Contributor

A TPKT length of 0x0103 is read as 3 because the high byte is discarded. This sends the negotiation response to the heuristic parser and loses its RDP banner.

The regression feeds the prefix of a 259-byte TPKT as one buffer and at every two-part split. All 19 cases fail before the fix; make test passes after it on macOS arm64.

Signed-off-by: Dmitry Rantovov <rantovov5@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant