# Attacker-controlled index past fixed array

Buffer sized by one count but indexed by another attacker-controlled value; check index against allocation

_Area: Memory corruption and native code. Seen in 5 disclosed reports; 3 confirmed bounties, median $1,500, range $500-$1,500; latest 2026-10-20. Updated 2026-10-23._

## How it works
Code allocates a buffer or vector using one bound (a palette size, a hardcoded level count, a fixed growth increment, a window size) but later indexes it with a different value taken from input (a pixel value, a mip level, a nesting depth, a channel offset). The two bounds are assumed to agree. When input makes the index larger than the allocation, the read or write lands outside it. The bug is a mismatch between the sizing bound and the indexing bound, not a missing check on a single number.

## Where it shows up
- A buffer sized by `colorsTotal`, `max_levels`, `windows_size`, or a `+N` growth step, then indexed by a pixel, level, depth, or channel value.
- A validator and an allocator that both call the same helper (e.g. `MaxLevelsForTarget`), but one construction path hardcodes a smaller size than the validator assumes [E2](https://bugbountylibrary.com/r/p0%3ACVE-2022-4135.md).
- Grow-by-constant allocators (`+20` per call) indexed by an attacker-controlled level without a loop that grows until `level < len` [E3](https://bugbountylibrary.com/r/h1%3A476179.md).
- Interpolation/weight arrays indexed by a computed channel offset that can equal the array length [E4](https://bugbountylibrary.com/r/h1%3A141202.md).
- Small palette combined with a high pixel index [E1](https://bugbountylibrary.com/r/h1%3A478368.md).

## How to review
For every array access, find the expression that sized the allocation and the expression that produces the index. Confirm the index is provably less than the size on all paths, including construction paths that bypass the shared helper. The invariant: index < allocated length, enforced at the access or guaranteed by construction. Check that growth loops actually reach the requested index, and that validators and allocators derive bounds from the same source.

## Variants seen
- Palette size vs pixel value mismatch in image code [E1](https://bugbountylibrary.com/r/h1%3A478368.md).
- Hardcoded level count vs validator's max-level helper [E2](https://bugbountylibrary.com/r/p0%3ACVE-2022-4135.md).
- Fixed-increment growth vs attacker-controlled nesting level [E3](https://bugbountylibrary.com/r/h1%3A476179.md).
- Weight window size vs computed channel index (off-by-one read) [E4](https://bugbountylibrary.com/r/h1%3A141202.md).

## Impact and severity
Heap OOB write enabling sandbox/safe_mode bypass [E1](https://bugbountylibrary.com/r/h1%3A478368.md), GPU-process heap corruption in a browser [E2](https://bugbountylibrary.com/r/p0%3ACVE-2022-4135.md), heap corruption and crash [E3](https://bugbountylibrary.com/r/h1%3A476179.md), and memory disclosure via OOB read [E4](https://bugbountylibrary.com/r/h1%3A141202.md). Severity rises when the write is reachable from untrusted content and crosses a privilege boundary; small overruns still corrupt heap metadata.

## Why fixes fail
Evidence does not show incomplete or regressed fixes.

## Evidence
- E1: https://bugbountylibrary.com/r/h1%3A478368.md
- E2: https://bugbountylibrary.com/r/p0%3ACVE-2022-4135.md
- E3: https://bugbountylibrary.com/r/h1%3A476179.md
- E4: https://bugbountylibrary.com/r/h1%3A141202.md