The Length Field That Lied

Memory Corruption · May 12, 2026 · 1 min read
#oob-write#parsing

A short one, because the bug is short. A parser read a 16-bit length from the wire and used it to size a copy into a buffer it had already allocated based on a different field. The two were assumed to agree. They were not required to.

The mismatch

The allocation used header.count * sizeof(entry). The copy loop ran until header.length bytes were consumed. Send a small count with a large length and the write walks straight off the end of the allocation, one attacker-chosen entry at a time.

The takeaway

If a size comes from input, it is not a size — it is a claim. The number of bytes you are willing to write is a property of your allocation, never of the attacker’s header. Compute the bound yourself, clamp to it, and treat any disagreement as hostile.

all writeups rss