# Parser length/offset mismatch

A length or offset checked in one place but a copy uses a stale or differently-derived value

_Area: Memory corruption and native code. Seen in 5 disclosed reports; one confirmed bounty: $40,000; latest 2026-10-20. Updated 2026-10-23._

## How it works
A parser derives a length or offset, then a later copy or write uses a different value. Between the two steps the effective size changes: a cap truncates it, a sanitizer strips bytes, a second parser resolves the same field differently, or a state flag from an earlier step alters how much is written. The copy trusts the old number, so it reads or writes past the real buffer. The broken assumption: the length I checked is the length I use, computed from the same source, after every transformation.

## Where it shows up
- A size is clamped to a max but the offset passed to the copy is not adjusted [E1](https://bugbountylibrary.com/r/blog%3Ablog-doyensec-com-2025-10-08-ksmbd-3-html.md).
- A buffer is sized from one library's parse but unpacked using another parser's view of the same tags [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-c6hw-5grf-ff96.md).
- A string and its length cross a language boundary; one layer strips bytes (null, CRLF, Unicode) and the other keeps the original count [E3](https://bugbountylibrary.com/r/blog%3Asamcurry-net-filling-in-the-blanks-exploiting-null-byte-buffer-overflow-for-a-40000-bounty.md).
- A length pass and a copy pass disagree: a persistent flag (is_args) survives a rewrite and changes the escaping factor, or the escape budget is undercounted [E4](https://bugbountylibrary.com/r/blog%3Ablog-calif-io-p-needle-in-a-haystack-measuring-the.md).
- A length is computed from one buffer (server path) but used to index a different caller-supplied buffer [E5](https://bugbountylibrary.com/r/h1%3A1595296.md).

## How to review
Trace every length and offset from parse to use and confirm they are recomputed together after any transformation. The invariant: for every copy/write, `offset + count <= buffer_size` holds using the same values the copy actually uses, and any cap, strip, or flag change updates both. When two parsers touch the same field, verify the sizing parser and the unpacking parser agree on that field (duplicated tags, first-wins vs last-wins). In config or script engines, check that state flags set in one directive are reset before the next. At language boundaries, verify the receiver derives length from the received bytes, not a caller-supplied count.

## Variants seen
- Truncated size with original offset in a kernel xattr write [E1](https://bugbountylibrary.com/r/blog%3Ablog-doyensec-com-2025-10-08-ksmbd-3-html.md).
- Buffer sized from libtiff's IFD parse, rows unpacked from Pillow's parse; duplicated tags disagree [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-c6hw-5grf-ff96.md).
- Null-byte stripping without decrementing length across FFI [E3](https://bugbountylibrary.com/r/blog%3Asamcurry-net-filling-in-the-blanks-exploiting-null-byte-buffer-overflow-for-a-40000-bounty.md).
- Stale is_args flag and undercounted escape budget across rewrite passes [E4](https://bugbountylibrary.com/r/blog%3Ablog-calif-io-p-needle-in-a-haystack-measuring-the.md).
- Length from one buffer used to index another [E5](https://bugbountylibrary.com/r/h1%3A1595296.md).

## Impact and severity
Local root via heap corruption [E1](https://bugbountylibrary.com/r/blog%3Ablog-doyensec-com-2025-10-08-ksmbd-3-html.md); heap over-read leaking memory into returned pixels [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-c6hw-5grf-ff96.md); secret disclosure from uninitialized memory [E3](https://bugbountylibrary.com/r/blog%3Asamcurry-net-filling-in-the-blanks-exploiting-null-byte-buffer-overflow-for-a-40000-bounty.md); heap overflow in a widely deployed server [E4](https://bugbountylibrary.com/r/blog%3Ablog-calif-io-p-needle-in-a-haystack-measuring-the.md); out-of-bounds read [E5](https://bugbountylibrary.com/r/h1%3A1595296.md). Severity rises when the path is pre-auth, remotely reachable, or crosses a privilege boundary.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Ablog-doyensec-com-2025-10-08-ksmbd-3-html.md
- E2: https://bugbountylibrary.com/r/ghsa%3AGHSA-c6hw-5grf-ff96.md
- E3: https://bugbountylibrary.com/r/blog%3Asamcurry-net-filling-in-the-blanks-exploiting-null-byte-buffer-overflow-for-a-40000-bounty.md
- E4: https://bugbountylibrary.com/r/blog%3Ablog-calif-io-p-needle-in-a-haystack-measuring-the.md
- E5: https://bugbountylibrary.com/r/h1%3A1595296.md