# Trusted length field drives copy

Length, size, or capacity from input or config used as copy size or loop bound without checking real space

_Area: Memory corruption and native code. Seen in 6 disclosed reports; one confirmed bounty: $20,000; latest 2026-10-20. Updated 2026-10-23._

## How it works
A parser reads a length, offset/size pair, or capacity value from network, IPC, or config input and uses it directly as a `memcpy` size, loop bound, or pointer advance. The code assumes the declared number matches the bytes actually present and fits the destination. When the sender lies — a length larger than the buffer, a length that underflows, a size field that disagrees with a second field, or a config value that diverges from the real allocation — the copy runs past the allocation. The root cause is a missing comparison between the attacker's number and the real remaining space or destination capacity.

## Where it shows up
- Decode handlers copying length-prefixed fields into fixed-size inline structs, even 1-byte lengths [E1](https://bugbountylibrary.com/r/blog%3Asector7-computest-nl-post-2021-08-zoom.md)[E5](https://bugbountylibrary.com/r/h1%3A824771.md)
- Crypto paths where one algorithm validates length and a sibling does not [E1](https://bugbountylibrary.com/r/blog%3Asector7-computest-nl-post-2021-08-zoom.md)
- Peer-described struct layouts: `field_offset + field_size` used without bounds check [E3](https://bugbountylibrary.com/r/blog%3Ablog-quarkslab-com-vulnerabilities-in-the-tpm-20-reference-implementation-code-html.md)
- Reassembly that walks headers with one length but accounts bytes with another [E4](https://bugbountylibrary.com/r/p0%3ACVE-2020-1027.md)
- In-place decryption that advances the pointer but forgets to shrink `bufferSize` [E3](https://bugbountylibrary.com/r/blog%3Ablog-quarkslab-com-vulnerabilities-in-the-tpm-20-reference-implementation-code-html.md)
- Copy length set to total buffer size instead of remaining space (`size - offset`) [E5](https://bugbountylibrary.com/r/h1%3A824771.md)
- IPC struct field reused as output capacity, trusted as `memcpy` bound across a privilege boundary [E4](https://bugbountylibrary.com/r/p0%3ACVE-2020-1027.md)
- Size argument sourced from a default/config value that disagrees with the actual buffer capacity [E6](https://bugbountylibrary.com/r/h1%3A550696.md)
- Wrapper pre-sizes a buffer from a requested scale/geometry, but the library silently ignores it and returns more data than allocated [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-8g5g-8vmr-9782.md)

## How to review
List every `memcpy`/`bcopy`/loop bound and trace its size argument to its source. The invariant: before any copy or loop, `declared_length <= remaining_input_bytes` AND `declared_length <= destination_capacity`. Compute in this order: advance the pointer past the size field, subtract the field width from the remaining length, then compare. Guard unsigned underflow — E3 is the canonical case: after advancing 2 bytes the code never subtracts 2, so the check passes 2 bytes too late. For offset/size pairs, verify `offset + size` cannot wrap and stays inside the allocation [E3](https://bugbountylibrary.com/r/blog%3Ablog-quarkslab-com-vulnerabilities-in-the-tpm-20-reference-implementation-code-html.md). At library call sites, confirm the size argument equals the real buffer size, not a caller-supplied or stale default value [E6](https://bugbountylibrary.com/r/h1%3A550696.md). When a wrapper pre-sizes from a requested scale, verify the library actually honors it for every accepted codec and validate returned dimensions against allocated capacity [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-8g5g-8vmr-9782.md). Avoid false positives: a length already clamped upstream against the true buffer is safe — confirm the clamp uses the real capacity.

## Variants seen
- Fixed destination buffer, unchecked decrypted length [E1](https://bugbountylibrary.com/r/blog%3Asector7-computest-nl-post-2021-08-zoom.md)
- Small length field overflowing adjacent heap chunk [E5](https://bugbountylibrary.com/r/h1%3A824771.md)
- Peer-supplied offset/size writing past stack struct [E3](https://bugbountylibrary.com/r/blog%3Ablog-quarkslab-com-vulnerabilities-in-the-tpm-20-reference-implementation-code-html.md)
- Dual-length disagreement in reassembly: walk length vs account length [E4](https://bugbountylibrary.com/r/p0%3ACVE-2020-1027.md)
- Pointer advance without size adjustment in in-place decryption [E3](https://bugbountylibrary.com/r/blog%3Ablog-quarkslab-com-vulnerabilities-in-the-tpm-20-reference-implementation-code-html.md)
- Total-size vs remaining-space confusion in buffered reads [E5](https://bugbountylibrary.com/r/h1%3A824771.md)
- IPC output capacity field trusted as copy bound [E4](https://bugbountylibrary.com/r/p0%3ACVE-2020-1027.md)
- Stale default size used as read length while buffer sized from config [E6](https://bugbountylibrary.com/r/h1%3A550696.md)
- Library ignores requested scaling, returns larger geometry than buffer [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-8g5g-8vmr-9782.md)

## Impact and severity
Led to heap/stack overflow, OOB read/write, pointer leaks, and RCE — often preauth or zero-click [E1](https://bugbountylibrary.com/r/blog%3Asector7-computest-nl-post-2021-08-zoom.md)[E4](https://bugbountylibrary.com/r/p0%3ACVE-2020-1027.md), sometimes kernel-level [E3](https://bugbountylibrary.com/r/blog%3Ablog-quarkslab-com-vulnerabilities-in-the-tpm-20-reference-implementation-code-html.md). Severity rises when reachable without authentication, when the overflow lands next to a function pointer or freelist [E4](https://bugbountylibrary.com/r/p0%3ACVE-2020-1027.md)[E5](https://bugbountylibrary.com/r/h1%3A824771.md), and when it crosses a sandbox or privilege boundary [E4](https://bugbountylibrary.com/r/p0%3ACVE-2020-1027.md).

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Asector7-computest-nl-post-2021-08-zoom.md
- E2: https://bugbountylibrary.com/r/ghsa%3AGHSA-8g5g-8vmr-9782.md
- E3: https://bugbountylibrary.com/r/blog%3Ablog-quarkslab-com-vulnerabilities-in-the-tpm-20-reference-implementation-code-html.md
- E4: https://bugbountylibrary.com/r/p0%3ACVE-2020-1027.md
- E5: https://bugbountylibrary.com/r/h1%3A824771.md
- E6: https://bugbountylibrary.com/r/h1%3A550696.md