# Fixed stack buffer overflow from count

Attacker-controlled count or length copied into a fixed-size stack array without a bounds check

_Area: Memory corruption and native code. Seen in 7 disclosed reports; one confirmed bounty: $5,000; latest 2024-09-30. Updated 2026-10-23._

## How it works
A function declares a fixed-size stack array (e.g. `ptrs[2]`, a 4096-byte voice buffer) sized for the normal case, then loops or copies using a count or length taken from the input. The code assumes the count matches the array size, but nothing enforces that. When the count exceeds the array, writes land past the array on the stack, corrupting adjacent locals, saved pointers, or the return path. The root cause is a missing invariant: count <= array capacity.

## Where it shows up
- Fixed-size stack arrays indexed or filled by a loop bound read from the message or object (numMasters, m_nLength, header length).
- Length fields in different units than the buffer (bits vs bytes) with a conversion step that is not checked against capacity.
- Parsers for rare or undocumented object types where the normal-case size is small but the format allows more.
- Mode-specific parsing paths (reverse-proxy vs forward-proxy) that use different length handling.
- Subtractions or arithmetic on lengths before the copy that can wrap or exceed the buffer.

## How to review
For every fixed stack array, find every write into it and confirm the bound is checked against the array's declared size, not against a separate assumption. The property that must hold: the number of elements written is provably <= the array capacity on all paths, including after unit conversion and arithmetic. Check that the count source is attacker-controlled and that no earlier validation clamps it. Watch for loops whose bound comes from parsed data while the array size is a literal.

## Variants seen
- Loop over an object count (0-16) into a 2-element array, with adjacent arrays overlapping attacker data to give write-what-where [E1](https://bugbountylibrary.com/r/p0%3ACVE-2020-1020.md).
- Host header copied into a fixed stack buffer via an overflowing subtraction in reverse-proxy mode [E2](https://bugbountylibrary.com/r/h1%3A778610.md).
- Bit-length field converted to bytes and read into a 4096-byte buffer without a fit check [E3](https://bugbountylibrary.com/r/h1%3A733267.md).

## Impact and severity
Led to in-the-wild exploitation with write-what-where [E1](https://bugbountylibrary.com/r/p0%3ACVE-2020-1020.md), server crash, memory leak, and possible RCE without stack protector [E2](https://bugbountylibrary.com/r/h1%3A778610.md), and remote code execution on other players' machines [E3](https://bugbountylibrary.com/r/h1%3A733267.md). Severity rises when the overflow reaches saved pointers or return addresses, when stack protector is absent, and when the input crosses a trust boundary between clients or over the network.

## Evidence
- E1: https://bugbountylibrary.com/r/p0%3ACVE-2020-1020.md
- E2: https://bugbountylibrary.com/r/h1%3A778610.md
- E3: https://bugbountylibrary.com/r/h1%3A733267.md