# [MK8DX] Improper metadata parsing

MK8DX tournament metadata ChunkData parser failed to validate chunk length, letting oversized chunks overflow a 0x400 buffer and crash players opening the Tournament menu.

- Payout: hidden
- Severity: critical
- Program: Nintendo
- Found by: crazy_man123
- Disclosed: 2023-08-17
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1688309
- Library page: https://bugbountylibrary.com/r/h1%3A1688309
- Tags: area:os domain:desktop impact:dos kind:bounty platform:hackerone sev:critical tech:payment technique:source-review vuln:dos vuln:memory-corruption

**Target:** Switch/WiiU game tournament metadata (ChunkData) parser
**Root cause:** ChunkDataAccessor::parse() reads a uint16 length and copies that many bytes into a fixed 0x400 tmpBuffer without validating length against buffer size or the 0x200 metadata limit.
**Steps:**
1. Craft tournament metadata in ChunkData format: magic `0x5a5a`, then a ChunkDataList with ID `2` (competition name) and a length field larger than 0x400
2. Place the crafted metadata in a SimpleSearchObject for a competition/tournament
3. Create an official competition carrying this metadata (via the separate bug allowing official competition creation)
4. Any player opening the Tournament menu parses the metadata, overflows tmpBuffer, and the process crashes
**How found:** Code review of CompetitionInfo::extractUniqueAppData_ and ChunkDataAccessor::parse revealed the length field was copied without bounds validation; noted server enforces 0x200 limit but parser buffer is 0x400.
**Exploitation:** Attacker creates an official competition whose metadata contains an oversized chunk length; victims opening the Tournament menu trigger the parser overflow and crash.
**Escalation:** Combined with a separate bug permitting creation of official competitions to reach all players.
**Insight:** When a server-side size limit exists, check whether the client parser's own buffer is larger than that limit — the gap between enforced and assumed sizes is where overflow lives; also note the fix added a <=0x400 check.