# Integer overflow in allocation size

Input-derived size arithmetic that wraps before allocation while the copy uses the true length

_Area: Memory corruption and native code. Seen in 32 disclosed reports; 15 confirmed bounties, median $500, range $100-$7,500; latest 2026-07-10. Updated 2026-10-23._

## How it works
A size is computed from attacker-influenced values (count times element size, length plus header, accumulated counts) in a fixed-width integer. The arithmetic wraps, so the value used to allocate is small or zero, but the value used to copy or fill is the true, large one. The allocation succeeds, the write does not fit, and the heap is corrupted. The broken assumption is that "the number I computed for the allocation equals the number of bytes I will write." Signed wrap can go negative and slip past a `> limit` check; unsigned wrap goes small and slips past a `< limit` check. Both must be rejected.

## Where it shows up
- Range/overlap checks computing `start + size` without detecting wrap, so `end < start` passes and the range is later inserted into a structure that sizes or indexes memory [E1](https://bugbountylibrary.com/r/p0%3ACVE-2023-33107.md).
- Narrow capacity fields (e.g. 16-bit) incremented without a wrap check, then used to size a buffer while a separate count drives the memmove [E3](https://bugbountylibrary.com/r/blog%3Athezdi-com-blog-2026-7-9-cve-2026-47291-remote-code-execution-in-the-windows-httpsys.md).
- Merge/combine functions accumulating counts without overflow check, where the wrapped total sizes a buffer but per-element writes use true counts [E2](https://bugbountylibrary.com/r/p0%3ACVE-2023-6345.md).
- `int`/`short` variables assigned from `strlen`/`size_t` and summed into an allocation size, truncating on 64-bit [E4](https://bugbountylibrary.com/r/h1%3A271330.md).
- A capacity bound mixing element counts and byte counts, so the check permits a length whose byte size overflows [E5](https://bugbountylibrary.com/r/h1%3A185899.md).
- `len * N + C` passed to malloc where the multiply wraps on 32-bit size_t [E6](https://bugbountylibrary.com/r/h1%3A547630.md).
- Length times max-expansion constant computed in a `long` that is 32-bit on the target platform, wrapping the allocation while the copy loop writes the full expanded length [E7](https://bugbountylibrary.com/r/h1%3A1455248.md).
- `width * height * bytes-per-pixel` in image/codec code, wrapping to a small allocation while the per-pixel loop writes the true size [E8](https://bugbountylibrary.com/r/h1%3A170619.md).

## How to review
Find every allocation whose size is derived from input, and trace the same expression to the copy/fill sink (memcpy, memmove, memset, row-fill loops). The invariant: the allocation size and the write size must be computed by the same checked arithmetic, and any wrap must be rejected before allocation. Use checked forms (`__builtin_mul_overflow`, `checked_mul`/`checked_add`, or explicit pre-multiply division tests) rather than trusting the result. Check that bounds tests reject `end < start` [E1](https://bugbountylibrary.com/r/p0%3ACVE-2023-33107.md). For narrowing conversions, verify the value is range-checked before it is stored into a uint16/uint32 capacity field and that the widened value sizes the allocation [E3](https://bugbountylibrary.com/r/blog%3Athezdi-com-blog-2026-7-9-cve-2026-47291-remote-code-execution-in-the-windows-httpsys.md)[E4](https://bugbountylibrary.com/r/h1%3A271330.md). For merge/combine code, confirm the accumulated count is checked before it sizes a buffer and that per-element writes use the same checked total [E2](https://bugbountylibrary.com/r/p0%3ACVE-2023-6345.md). Confirm the width of the type actually used on the target platform, not the source's apparent width [E7](https://bugbountylibrary.com/r/h1%3A1455248.md).

## Variants seen
- Address+size wrap in a range check feeding an rbtree insert [E1](https://bugbountylibrary.com/r/p0%3ACVE-2023-33107.md).
- Unchecked accumulation of vertex counts in a merge function sizing the vertex buffer [E2](https://bugbountylibrary.com/r/p0%3ACVE-2023-6345.md).
- 16-bit capacity counter wrap sizing a buffer while a larger count drives memmove [E3](https://bugbountylibrary.com/r/blog%3Athezdi-com-blog-2026-7-9-cve-2026-47291-remote-code-execution-in-the-windows-httpsys.md).
- 32-bit `int` sum of two `size_t` lengths in an env-string allocation [E4](https://bugbountylibrary.com/r/h1%3A271330.md).
- Element-count vs byte-count bound mismatch permitting an oversized array allocation [E5](https://bugbountylibrary.com/r/h1%3A185899.md).
- `len * 2 + 2` wrap in a URL parser's scratch buffer [E6](https://bugbountylibrary.com/r/h1%3A547630.md).
- 32-bit `long` multiply wrap in a C extension's escape-buffer sizing [E7](https://bugbountylibrary.com/r/h1%3A1455248.md).
- Dimension product wrap in an image codec [E8](https://bugbountylibrary.com/r/h1%3A170619.md).

## Why fixes fail
A prior range-validation helper added to fix an earlier bug was itself missing overflow checks, so the wrap path survived [E1](https://bugbountylibrary.com/r/p0%3ACVE-2023-33107.md). Audit any new validation helper for arithmetic wrap before trusting it, and re-check it against the same input shapes that defeated the original code.

## Impact and severity
Heap overflow leading to memory corruption in kernel, browser, and application contexts [E1](https://bugbountylibrary.com/r/p0%3ACVE-2023-33107.md)[E2](https://bugbountylibrary.com/r/p0%3ACVE-2023-6345.md)[E3](https://bugbountylibrary.com/r/blog%3Athezdi-com-blog-2026-7-9-cve-2026-47291-remote-code-execution-in-the-windows-httpsys.md)[E4](https://bugbountylibrary.com/r/h1%3A271330.md)[E6](https://bugbountylibrary.com/r/h1%3A547630.md)[E7](https://bugbountylibrary.com/r/h1%3A1455248.md)[E8](https://bugbountylibrary.com/r/h1%3A170619.md). Severity is high where the overflow lands in a privileged allocator or crosses a sandbox boundary [E1](https://bugbountylibrary.com/r/p0%3ACVE-2023-33107.md)[E2](https://bugbountylibrary.com/r/p0%3ACVE-2023-6345.md)[E3](https://bugbountylibrary.com/r/blog%3Athezdi-com-blog-2026-7-9-cve-2026-47291-remote-code-execution-in-the-windows-httpsys.md). The missing overflow check in the post-fix helper left the original wrap path reachable [E1](https://bugbountylibrary.com/r/p0%3ACVE-2023-33107.md).

## Evidence
- E1: https://bugbountylibrary.com/r/p0%3ACVE-2023-33107.md
- E2: https://bugbountylibrary.com/r/p0%3ACVE-2023-6345.md
- E3: https://bugbountylibrary.com/r/blog%3Athezdi-com-blog-2026-7-9-cve-2026-47291-remote-code-execution-in-the-windows-httpsys.md
- E4: https://bugbountylibrary.com/r/h1%3A271330.md
- E5: https://bugbountylibrary.com/r/h1%3A185899.md
- E6: https://bugbountylibrary.com/r/h1%3A547630.md
- E7: https://bugbountylibrary.com/r/h1%3A1455248.md
- E8: https://bugbountylibrary.com/r/h1%3A170619.md