# [MK8DX] Improper metadata validation 2

Out-of-range chunk ID in tournament metadata caused a null-pointer read, crashing Mario Kart 8/8 Deluxe for anyone opening the Tournament menu.

- Payout: hidden
- Severity: high
- Program: Nintendo
- Found by: crazy_man123
- Disclosed: 2023-08-17
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1812732
- Library page: https://bugbountylibrary.com/r/h1%3A1812732
- Tags: area:os domain:desktop impact:dos kind:bounty platform:hackerone sev:high tech:rest technique:source-review vuln:dos vuln:memory-corruption

**Target:** Tournament metadata ChunkData parser (SimpleSearchObject)
**Root cause:** ChunkDataList parser lacked a range check on the chunk ID; an ID outside [0;12[ caused a lookup that returned nullptr, which was then dereferenced.
**Steps:**
1. Create a tournament whose metadata ChunkData contains a ChunkDataList with ID > 11 and < 255 (e.g. `0x5a5a` magic, then `ID=0x20`, `uint16 length`, data, `0xff` end marker)
2. Publish the tournament so it appears in the Tournament menu
3. Any player opening the Tournament menu loads the metadata and the client reads from nullptr, crashing the process/console
**How found:** Reading the client's ChunkDataList parsing code, noting the constructor restricts IDs to [0;12[ but the production parser had no range check, so an out-of-range ID would fail the buffer lookup and return nullptr.
**Exploitation:** Attacker creates a tournament with malformed metadata (out-of-range chunk ID) and, combined with a separate bug allowing creation of official competitions, gets it listed so any player opening the Tournament menu crashes.
**Escalation:** Chained with the official-competition creation bug to reach all players rather than only those who join a specific tournament.
**Insight:** When a container class enforces an ID range only via its constructor, check whether the deserializer bypasses that constructor and indexes a lookup table directly; out-of-range IDs then yield null entries that get dereferenced.