# Unvalidated chunk length copied to buffer

Length or ID field from input used to copy or index before checking against remaining bytes or table bounds

_Area: Memory corruption and native code. Seen in 3 disclosed reports; latest 2026-10-08. Updated 2026-11-02._

## How it works
A parser reads a length (or ID) field from attacker-controlled input and acts on it — copying that many bytes into a fixed buffer, or indexing a lookup table — before confirming the value fits the destination or the remaining input. The assumption that breaks is "the producer already constrained this field." When the producer is a server, a file format, or a sibling code path, that assumption is invisible in the parser and easy to violate. The result is a write past a fixed buffer, a slice/index panic, or a null dereference.

## Where it shows up
- A `uint16`/`uint32` length read then `memcpy`/`copy` into a fixed-size stack or heap buffer, with no comparison to buffer size or remaining bytes [E3](https://bugbountylibrary.com/r/h1%3A1688309.md).
- A parser buffer larger than the documented/enforced limit (e.g. server caps 0x200, parser buffer 0x400) — the gap is where overflow lives [E3](https://bugbountylibrary.com/r/h1%3A1688309.md).
- Deserializers that bypass a constructor which enforced an ID range, then index a table directly [E2](https://bugbountylibrary.com/r/h1%3A1812732.md).
- Sibling implementations (standard vs agile, v1 vs v2) where one validates stream length and the other does not [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-2j4c-ffch-9f23.md).
- Version/dispatch code that checks only `len(x) >= 4` before handing the buffer to a callee that assumes structure [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-2j4c-ffch-9f23.md).

## How to review
For every length or ID field, find the exact check that bounds it against the destination and the remaining input, and confirm it runs before use. The invariant: `field <= min(sizeof(dest), bytes_remaining)` and `id < table_size`, enforced in the parser itself, not only upstream. Check that deserializers re-validate ranges their constructors enforce. Diff sibling paths for asymmetric checks. Confirm malformed input yields a returned error, not a panic or crash.

## How finders spotted it
- Compared the standard and agile decrypt paths and noticed agile checked `len(EncryptedPackage) >= 8` while standard did not; then built malformed CFB containers varying headerSize, KeySize, verifier length, saltValue and blockSize, confirming each panic against pristine master [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-2j4c-ffch-9f23.md).
- Read the ChunkDataList parser and saw the constructor restricted IDs to [0;12[ but the production parser had no range check, so an out-of-range ID would fail the lookup and return nullptr [E2](https://bugbountylibrary.com/r/h1%3A1812732.md).
- Code review of `CompetitionInfo::extractUniqueAppData_` and `ChunkDataAccessor::parse` showed the length copied without bounds validation, and noted the server's 0x200 limit versus the 0x400 parser buffer [E3](https://bugbountylibrary.com/r/h1%3A1688309.md).

## Variants seen
- Fixed-buffer overflow from oversized chunk length [E3](https://bugbountylibrary.com/r/h1%3A1688309.md).
- Out-of-range ID causing null-pointer dereference [E2](https://bugbountylibrary.com/r/h1%3A1812732.md).
- Missing length validation causing slice-bounds, index, IV-length and divide-by-zero panics in a Go library [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-2j4c-ffch-9f23.md).

## Impact and severity
Crashes of the whole process or client: unrecovered panics kill a Go service [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-2j4c-ffch-9f23.md); malformed tournament metadata crashes every player opening the Tournament menu [E2](https://bugbountylibrary.com/r/h1%3A1812732.md)[E3](https://bugbountylibrary.com/r/h1%3A1688309.md). Severity rose when chained with a separate bug allowing creation of official competitions, reaching all players rather than only those joining a specific tournament [E2](https://bugbountylibrary.com/r/h1%3A1812732.md)[E3](https://bugbountylibrary.com/r/h1%3A1688309.md). A fixed-buffer overflow [E3](https://bugbountylibrary.com/r/h1%3A1688309.md) carries memory-corruption potential beyond denial of service.

## Seen in real software
Open-source packages and projects, and products, where this pattern was found. If the target runs one, compare the version it runs with the fix.
- **github.com/xuri/excelize/v2 (go)** >= 2.3.1, < 2.11.1-0.20260915055537-22f76f9acb94, fixed in 2.11.1-0.20260915055537-22f76f9acb94: Excelize Decrypt: unrecoverable panics on malformed OLE/CFB encrypted workbooks (CVE-2026-107214). Report: https://bugbountylibrary.com/r/ghsa%3AGHSA-2j4c-ffch-9f23.md. Fix: https://github.com/qax-os/excelize/commit/22f76f9acb94b85b3eb9c4365ab4f750cebbc565

## Evidence
- E1: https://bugbountylibrary.com/r/ghsa%3AGHSA-2j4c-ffch-9f23.md
- E2: https://bugbountylibrary.com/r/h1%3A1812732.md
- E3: https://bugbountylibrary.com/r/h1%3A1688309.md