# Unbounded copy into fixed buffer

Copy length or source exceeds destination capacity; check every copy, expansion, and decode against the buffer it writes into

_Area: Memory corruption and native code. Seen in 28 disclosed reports; 14 confirmed bounties, median $1,068, range $350-$10,000; latest 2026-10-22. Updated 2026-10-23._

## How it works
A destination is sized for an expected maximum, but the write uses the source length, an input-derived count, or a transformed length that is never clamped to the destination capacity. The broken assumption is that the source, count, or expansion is bounded; nothing enforces it. A count-based copy is only safe if the count is clamped to the destination — an oversized or attacker-derived count is equally unbounded. The same failure appears when a loop index is driven by an input field rather than the array size, when a buffer is sized from a wrong capacity constant, or when a transform (wide-char conversion, escaping, base64 decode) produces more bytes than the destination was sized for. When output exceeds capacity, adjacent memory is overwritten: stack return addresses, adjacent globals, heap chunk headers, or struct members.

## Where it shows up
- strcpy/strcat/sprintf into fixed arrays, or memcpy/memmove with a length taken from input [E4](https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-all-your-d-base-are-belong-to-us-part-1-code-execution-in-apache-openoffice.md)[E7](https://bugbountylibrary.com/r/blog%3Amicrosoft-com-security-blog-2022-08-19-uncovering-a-chromeos-remote-memory-corruption-vulnerability.md)
- sscanf scansets like %[^-] with no width limit into fixed stack buffers
- Loops or copies bounded by an attacker field writing into fixed arrays [E3](https://bugbountylibrary.com/r/p0%3ACVE-2020-0938.md)[E5](https://bugbountylibrary.com/r/h1%3A272497.md)[E8](https://bugbountylibrary.com/r/p0%3ACVE-2022-22675.md)
- Two size descriptors where code allocates by one and copies by the other [E4](https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-all-your-d-base-are-belong-to-us-part-1-code-execution-in-apache-openoffice.md)
- Narrow-to-wide string conversion where the wide buffer is sized by character count, not expanded bytes [E2](https://bugbountylibrary.com/r/h1%3A470520.md)
- Sanitizers or encoders that expand input (escaping, base64) without recomputing worst-case output length, including the terminator [E6](https://bugbountylibrary.com/r/h1%3A3048061.md)
- Buffers sized from a fallback capacity constant smaller than the API's required maximum
- Protocol fields with no documented max: D-Bus strings [E7](https://bugbountylibrary.com/r/blog%3Amicrosoft-com-security-blog-2022-08-19-uncovering-a-chromeos-remote-memory-corruption-vulnerability.md)
- Asset/loader paths parsing filenames from untrusted files [E2](https://bugbountylibrary.com/r/h1%3A470520.md)
- Encoder states that emit without checking free buffer space [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-g7cr-3p24-7wf7.md)

## How to review
For every write, identify the destination size and the source bound, and confirm bytes written <= destination capacity for all attacker-reachable inputs. Check the length used is the destination size, not the source length or an input field. For loops, confirm the index bound is a constant matching the array, not an input field [E3](https://bugbountylibrary.com/r/p0%3ACVE-2020-0938.md)[E5](https://bugbountylibrary.com/r/h1%3A272497.md)[E8](https://bugbountylibrary.com/r/p0%3ACVE-2022-22675.md). For scansets, require an explicit width sized to the buffer. For transforms, validate worst-case expansion per input byte, not just the total [E2](https://bugbountylibrary.com/r/h1%3A470520.md)[E6](https://bugbountylibrary.com/r/h1%3A3048061.md). For resumable encoders, audit every emitting state for a free-space guard [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-g7cr-3p24-7wf7.md). When a length field bounds a copy, compare the field's declared max against the array size [E8](https://bugbountylibrary.com/r/p0%3ACVE-2022-22675.md). Trace whether overflowed neighbors are security-relevant state rather than assuming a crash [E2](https://bugbountylibrary.com/r/h1%3A470520.md)[E4](https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-all-your-d-base-are-belong-to-us-part-1-code-execution-in-apache-openoffice.md).

## Variants seen
- Wide-char conversion of an attacker player name overflowing a stack buffer [E2](https://bugbountylibrary.com/r/h1%3A470520.md)
- Loop count (num_master) with no upper bound writing past a 16-entry stack array [E3](https://bugbountylibrary.com/r/p0%3ACVE-2020-0938.md)
- memcpy of attacker fieldLength into a 4-byte integer [E4](https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-all-your-d-base-are-belong-to-us-part-1-code-execution-in-apache-openoffice.md)
- Unbounded $ENV key into a 1024-byte stack buffer [E5](https://bugbountylibrary.com/r/h1%3A272497.md)
- Escape routine doubling input past a 64-byte name buffer [E6](https://bugbountylibrary.com/r/h1%3A3048061.md)
- strcpy of D-Bus identity into a 128-byte heap buffer [E7](https://bugbountylibrary.com/r/blog%3Amicrosoft-com-security-blog-2022-08-19-uncovering-a-chromeos-remote-memory-corruption-vulnerability.md)
- Spec-bounded length field (cpb_cnt_minus1 up to 255) into a fixed 32-element buffer [E8](https://bugbountylibrary.com/r/p0%3ACVE-2022-22675.md)
- COM marker written after an exact-fit ICC profile fills the buffer [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-g7cr-3p24-7wf7.md)

## Why fixes fail
Patches that add a check in one path leave sibling paths open. Missing ASLR/canaries on appliances make small overflows easier to exploit [E2](https://bugbountylibrary.com/r/h1%3A470520.md)[E5](https://bugbountylibrary.com/r/h1%3A272497.md).

## Impact and severity
Pre-auth code execution as root on appliances [E2](https://bugbountylibrary.com/r/h1%3A470520.md)[E4](https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-all-your-d-base-are-belong-to-us-part-1-code-execution-in-apache-openoffice.md)[E7](https://bugbountylibrary.com/r/blog%3Amicrosoft-com-security-blog-2022-08-19-uncovering-a-chromeos-remote-memory-corruption-vulnerability.md), kernel stack corruption [E3](https://bugbountylibrary.com/r/p0%3ACVE-2020-0938.md)[E8](https://bugbountylibrary.com/r/p0%3ACVE-2022-22675.md), client compromise from a malicious server [E2](https://bugbountylibrary.com/r/h1%3A470520.md), peer crash/DoS [E6](https://bugbountylibrary.com/r/h1%3A3048061.md). Severity rises with pre-auth reachability, root/kernel context, and absent mitigations.

## Evidence
- E1: https://bugbountylibrary.com/r/ghsa%3AGHSA-g7cr-3p24-7wf7.md
- E2: https://bugbountylibrary.com/r/h1%3A470520.md
- E3: https://bugbountylibrary.com/r/p0%3ACVE-2020-0938.md
- E4: https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-all-your-d-base-are-belong-to-us-part-1-code-execution-in-apache-openoffice.md
- E5: https://bugbountylibrary.com/r/h1%3A272497.md
- E6: https://bugbountylibrary.com/r/h1%3A3048061.md
- E7: https://bugbountylibrary.com/r/blog%3Amicrosoft-com-security-blog-2022-08-19-uncovering-a-chromeos-remote-memory-corruption-vulnerability.md
- E8: https://bugbountylibrary.com/r/p0%3ACVE-2022-22675.md