# Unvalidated image header fields drive memory corruption

Header or pixel fields used as sizes, offsets, or indices before bounds checks

_Area: Memory corruption and native code. Seen in 2 disclosed reports; latest 2026-10-30. Updated 2026-10-31._

## How it works
Image loaders parse attacker-controlled headers and pixel data, then use those values as allocation sizes, buffer offsets, or array indices. The broken assumption is that declared fields (dimensions, channel counts, bit depth, box sizes, luminance) are consistent with the actual buffer. When they are not, writes or reads land outside the allocation. In [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-494m-4556-wf5p.md) the ICO loader reads BITMAPINFOHEADER fields from the entry data without checking `data_size`, then writes a reconstructed BMP header past a small heap buffer. In [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-j3p4-wp97-rph4.md) a non-finite luminance from crafted TIFF float samples is used directly as a histogram index.

## Where it shows up
- Header fields (width, height, bpp, num_colors, channel ids, box lengths) read before any length check against the containing buffer [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-494m-4556-wf5p.md)
- Reconstruction or re-serialization that writes a header into a buffer sized from a different, smaller value [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-494m-4556-wf5p.md)
- Pixel values converted to integer indices (histograms, LUTs, binning) without range or finiteness checks [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-j3p4-wp97-rph4.md)
- Sibling code paths where one validates a stream length and the other does not [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-2j4c-ffch-9f23.md)
- Float/Half pixel formats that can carry NaN or Infinity into integer arithmetic [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-j3p4-wp97-rph4.md)

## How to review
For every field taken from input, trace where it is used. The invariant: any value used as a size, offset, or index must be validated against the actual buffer length or a fixed bound before use. Check that each field offset is within the allocation, that reconstructed writes fit the destination, and that float-to-index conversions reject non-finite and out-of-range values. Diff parallel implementations for asymmetric checks [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-2j4c-ffch-9f23.md).

## Variants seen
- Header reconstruction writing past a heap buffer sized from a smaller declared value [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-494m-4556-wf5p.md)
- Missing length validation on attacker-controlled container streams causing panics [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-2j4c-ffch-9f23.md)
- Non-finite pixel value used as unchecked array index [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-j3p4-wp97-rph4.md)

## Why fixes fail
[E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-2j4c-ffch-9f23.md) shows the agile path already checked stream length while the standard path did not; fixing one sibling leaves the other exposed.

## Impact and severity
Heap out-of-bounds read/write and process crashes, remotely triggerable by unauthenticated input [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-494m-4556-wf5p.md)[E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-2j4c-ffch-9f23.md)[E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-j3p4-wp97-rph4.md). Severity rises when the loader runs in a shared worker or service, where a crash is a denial of service, and when the OOB write is reachable pre-authentication.

## Evidence
- E1: https://bugbountylibrary.com/r/ghsa%3AGHSA-494m-4556-wf5p.md
- E2: https://bugbountylibrary.com/r/ghsa%3AGHSA-2j4c-ffch-9f23.md
- E3: https://bugbountylibrary.com/r/ghsa%3AGHSA-j3p4-wp97-rph4.md