# Header field drives allocation or copy

Metadata size, offset or index used before validation against remaining bytes

_Area: Memory corruption and native code. Seen in 3 disclosed reports; latest 2026-07-09. Updated 2026-11-08._

## How it works
A length, offset or index taken from a header or metadata field is trusted before it is compared with the bytes actually present. The code then slices, allocates or copies using that value. When the field is larger than the real buffer, the operation reads or writes past the end, or runs on a buffer that was never filled. The broken assumption is that a field describing the data is consistent with the data itself; nothing enforces that before use.

## Where it shows up
- Slice or borrow expressions of the form `buf[0..size]` where `size` comes from parsed input [E2](https://bugbountylibrary.com/r/c4%3A2025-09-succinct%3AM-02.md)
- Allocation sized from a header field, followed by a read whose return value is not checked [E3](https://bugbountylibrary.com/r/h1%3A160294.md)
- Offset fields (thumbnail, table, chunk) used to seek or read without comparing to file or message length [E3](https://bugbountylibrary.com/r/h1%3A160294.md)
- Error macros that only log a warning and fall through instead of returning [E3](https://bugbountylibrary.com/r/h1%3A160294.md)
- A length check that exists, but only downstream of the code that first touches the buffer [E2](https://bugbountylibrary.com/r/c4%3A2025-09-succinct%3AM-02.md)
- Login or request handlers that serialize a struct or buffer into a response, including adjacent memory [E1](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-citrixbleed-2-dragonforce-ransomware.md)

## How to review
Find every place a parsed field becomes a size, offset or index. For each, confirm the check against remaining bytes happens on every path before the first use, not after. The invariant: at the point of any slice, allocation or copy, `field <= bytes_remaining` must already be established, and any short read must abort the path. Trace the order of operations, not just the presence of a check: a check in a callee does not protect a caller that borrows first [E2](https://bugbountylibrary.com/r/c4%3A2025-09-succinct%3AM-02.md). For error paths, confirm each logging macro is followed by a return or abort before the buffer is consumed [E3](https://bugbountylibrary.com/r/h1%3A160294.md). For response serialization, confirm the length written is the length of initialized data [E1](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-citrixbleed-2-dragonforce-ransomware.md).

## How finders spotted it
- Read the verifier flow and noticed the Borrow impl sliced unchecked while the length check lived in a later shard-level step, so a short vector panics first [E2](https://bugbountylibrary.com/r/c4%3A2025-09-succinct%3AM-02.md)
- Read the TIFF IFD handler, saw no offset-vs-filesize check, and saw the EOF error macro was a non-fatal warning with no exit, so execution continued into thumbnail build on an unfilled buffer [E3](https://bugbountylibrary.com/r/h1%3A160294.md)
- SOC analysts saw thousands of failed logins with unprintable usernames in logs, read them as leaked heap bytes, and tied them to a valid session from an attacker IP with no authentication [E1](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-citrixbleed-2-dragonforce-ransomware.md)

## Variants seen
- Out-of-bounds read leaking heap contents into a response (session tokens) [E1](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-citrixbleed-2-dragonforce-ransomware.md)
- Unchecked slice borrow causing a panic before validation (denial of service) [E2](https://bugbountylibrary.com/r/c4%3A2025-09-succinct%3AM-02.md)
- Uninitialized buffer returned as data, leaking pointers [E3](https://bugbountylibrary.com/r/h1%3A160294.md)

## Impact and severity
E1 was severe: leaked session tokens gave pre-auth session hijack, then privilege escalation, persistence and ransomware [E1](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-citrixbleed-2-dragonforce-ransomware.md). E3 leaked heap pointers usable to defeat ASLR/PIE [E3](https://bugbountylibrary.com/r/h1%3A160294.md). E2 was a crash-only DoS of verifier services [E2](https://bugbountylibrary.com/r/c4%3A2025-09-succinct%3AM-02.md). Impact rises when the leaked bytes are secrets or addresses, and when the leak is reachable pre-authentication [E1](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-citrixbleed-2-dragonforce-ransomware.md).

## Seen in real software
Open-source packages and projects, and products, where this pattern was found. If the target runs one, compare the version it runs with the fix.
- **Citrix NetScaler ADC and Gateway** (AAA virtual server login endpoint (/p/u/doAuthentication.do)) (version not stated): CitrixBleed 2 (CVE-2025-5777) 7Steps to Dragonforce Ransomware | Huntress (CVE-2025-5777). Report: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-citrixbleed-2-dragonforce-ransomware.md
- **PHP**: Memory Leakage In exif_process_IFD_in_TIFF (CVE-2016-7128) (CVE-2016-7128). Report: https://bugbountylibrary.com/r/h1%3A160294.md

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-citrixbleed-2-dragonforce-ransomware.md
- E2: https://bugbountylibrary.com/r/c4%3A2025-09-succinct%3AM-02.md
- E3: https://bugbountylibrary.com/r/h1%3A160294.md