# Encoder buffer size miscalculation

Destination sized from wrong offset, count, or format, then written past

_Area: Memory corruption and native code. Seen in 7 disclosed reports; 2 confirmed bounties: $2,000 and $10,000; latest 2026-10-21. Updated 2026-10-23._

## How it works
A writer computes how much space its destination needs, then writes. The computation and the write disagree: the size comes from a different quantity than the bytes actually produced. The destination is allocated too small, and the write runs past it. The mismatch is always between two representations of the same length — allocated size vs. write offset, a size hint vs. actual output, a shift vs. a multiply, a truncated vs. untruncated length, a fallback format vs. the real one.

## Where it shows up
- Buffer growth sized from current size rather than write offset, especially when a library emulates file semantics (seek past EOF) over memory [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-332p-7hrc-92wf.md)
- Two-call APIs: first call returns a size hint, second fills; hint derived from a different parse than the output [E3](https://bugbountylibrary.com/r/h1%3A1352429.md)
- `x << n` used as multiplication where `n` is attacker-controlled [E4](https://bugbountylibrary.com/r/h1%3A897606.md)
- Enum-to-enum mapping with a default fallback that picks a smaller format [E5](https://bugbountylibrary.com/r/p0%3ACVE-2020-16010.md)
- `snprintf` return value used as an index or added to a length without clamping [E6](https://bugbountylibrary.com/r/h1%3A112723.md)
- Padding loops walking a pointer backwards on an attacker-controlled count [E7](https://bugbountylibrary.com/r/h1%3A180572.md)
- Allocation that omits a header/field size later used as a write offset [E1](https://bugbountylibrary.com/r/blog%3Agoogle-github-io-security-research-pocs-linux-cve-2021-22555-writeup-html.md)

## How to review
Find every write into a sized buffer and trace both numbers to their source. The invariant: the capacity check must be computed from the same parsed structure and the same offset as the write itself. Check that size hints and fill paths share one derivation; that shifts are replaced by checked multiplication; that enum fallbacks never shrink the destination; that `snprintf`-style returns are clamped before indexing; that padding counts are bounded by remaining space; that allocations include every field later used as an offset. For in-memory file emulation, verify capacity is computed from the write offset, not current size.

## Variants seen
- Missing header size in allocation, zero-fill past end [E1](https://bugbountylibrary.com/r/blog%3Agoogle-github-io-security-research-pocs-linux-cve-2021-22555-writeup-html.md)
- realloc from `state->size` instead of `state->loc` [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-332p-7hrc-92wf.md)
- Size hint undercounts actual decrypted length [E3](https://bugbountylibrary.com/r/h1%3A1352429.md)
- Shift-as-multiply overestimates free space [E4](https://bugbountylibrary.com/r/h1%3A897606.md)
- Format fallback halves destination size [E5](https://bugbountylibrary.com/r/p0%3ACVE-2020-16010.md)
- Truncated-length return used unbounded [E6](https://bugbountylibrary.com/r/h1%3A112723.md)
- Unbounded backward padding loop [E7](https://bugbountylibrary.com/r/h1%3A180572.md)

## Impact and severity
Range: heap overflow, OOB write, info leak, up to kernel UAF with root and container escape [E1](https://bugbountylibrary.com/r/blog%3Agoogle-github-io-security-research-pocs-linux-cve-2021-22555-writeup-html.md), RCE [E4](https://bugbountylibrary.com/r/h1%3A897606.md). Severity rises when the primitive is reachable pre-auth or from untrusted files, and when the overflow is small but controllable (zero bytes, single newline) yet lands on a sensitive adjacent object [E1](https://bugbountylibrary.com/r/blog%3Agoogle-github-io-security-research-pocs-linux-cve-2021-22555-writeup-html.md)[E6](https://bugbountylibrary.com/r/h1%3A112723.md).

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Agoogle-github-io-security-research-pocs-linux-cve-2021-22555-writeup-html.md
- E2: https://bugbountylibrary.com/r/ghsa%3AGHSA-332p-7hrc-92wf.md
- E3: https://bugbountylibrary.com/r/h1%3A1352429.md
- E4: https://bugbountylibrary.com/r/h1%3A897606.md
- E5: https://bugbountylibrary.com/r/p0%3ACVE-2020-16010.md
- E6: https://bugbountylibrary.com/r/h1%3A112723.md
- E7: https://bugbountylibrary.com/r/h1%3A180572.md