# Length field trusted before data check

Header length used for allocation or copy before validating it against bytes actually present

_Area: Memory corruption and native code. Seen in 2 disclosed reports; latest 2026-10-26. Updated 2026-11-02._

## How it works
A parser reads a length field from the input (ASN.1 header, TIFF/EXIF offset, TCP urgent pointer) and acts on it — allocating a buffer, sizing a copy, or computing a read — before confirming the input actually contains that many bytes. The length is attacker-controlled data treated as a trusted fact. When the claimed length exceeds the real data, the code either allocates far more than needed [E3](https://bugbountylibrary.com/r/h1%3A134880.md), reads past the valid region [E1](https://bugbountylibrary.com/r/blog%3Ablog-quarkslab-com-snapshotting-our-way-to-cve-2026-9539-html.md), or proceeds on a buffer that was never filled [E2](https://bugbountylibrary.com/r/h1%3A160294.md). The broken assumption is "the length field describes the data that follows"; nothing enforces it.

## Where it shows up
- Decoders that pre-allocate from a declared length before streaming input (BIO/ASN.1, container formats) [E3](https://bugbountylibrary.com/r/h1%3A134880.md)
- Offset/size fields in image metadata (TIFF/EXIF thumbnail offset) used without a file-size check [E2](https://bugbountylibrary.com/r/h1%3A160294.md)
- Protocol fields (urgent pointer) validated against an intermediate buffer size rather than valid data length [E1](https://bugbountylibrary.com/r/blog%3Ablog-quarkslab-com-snapshotting-our-way-to-cve-2026-9539-html.md)
- Error macros that only log a warning and fall through instead of aborting the path [E2](https://bugbountylibrary.com/r/h1%3A160294.md)
- Arithmetic on lengths (subtraction, pointer math) that can underflow when claimed > available [E1](https://bugbountylibrary.com/r/blog%3Ablog-quarkslab-com-snapshotting-our-way-to-cve-2026-9539-html.md)

## How to review
For every length/offset field, find the check that ties it to actual available bytes and confirm it runs *before* allocation, copy or read. The invariant: no allocation, copy or read may be sized by an input field until that field has been proven ≤ the bytes actually present. Check that error paths return/abort rather than continue on unfilled buffers [E2](https://bugbountylibrary.com/r/h1%3A160294.md). Check length arithmetic for underflow when claimed exceeds available [E1](https://bugbountylibrary.com/r/blog%3Ablog-quarkslab-com-snapshotting-our-way-to-cve-2026-9539-html.md). For streaming decoders, confirm incremental reads detect unexpected EOF instead of pre-allocating [E3](https://bugbountylibrary.com/r/h1%3A134880.md).

## How finders spotted it
- Built a snapshot fuzzer for the TCP state machine; ASAN missed the OOB inside a custom allocator, so they added UBSAN integer-overflow detection and confirmed the underflow at a specific source line [E1](https://bugbountylibrary.com/r/blog%3Ablog-quarkslab-com-snapshotting-our-way-to-cve-2026-9539-html.md).
- Code review noticed a missing offset-vs-filesize check and that the EOF error macro was a non-fatal warning with no exit, so execution continued into the build routine on an unfilled buffer [E2](https://bugbountylibrary.com/r/h1%3A160294.md).
- Crafted minimal encodings with oversized length fields and watched the process consume large CPU, memory and swap — resource blowup as the tell [E3](https://bugbountylibrary.com/r/h1%3A134880.md).

## Variants seen
- Huge allocation from a tiny header claiming an enormous length [E3](https://bugbountylibrary.com/r/h1%3A134880.md)
- OOB read via integer underflow from a pointer checked against the wrong bound [E1](https://bugbountylibrary.com/r/blog%3Ablog-quarkslab-com-snapshotting-our-way-to-cve-2026-9539-html.md)
- Uninitialized-memory disclosure when a non-fatal error lets a build proceed on an unfilled buffer [E2](https://bugbountylibrary.com/r/h1%3A160294.md)

## Impact and severity
Leaked heap contents including prior allocation leftovers (128KiB receive buffer) [E1](https://bugbountylibrary.com/r/blog%3Ablog-quarkslab-com-snapshotting-our-way-to-cve-2026-9539-html.md); uninitialized heap memory exposing pointers to defeat ASLR/PIE [E2](https://bugbountylibrary.com/r/h1%3A160294.md); memory/swap exhaustion from oversized allocation [E3](https://bugbountylibrary.com/r/h1%3A134880.md). Severity rises when the leak is reachable remotely and yields pointers useful for a later exploit [E2](https://bugbountylibrary.com/r/h1%3A160294.md).

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Ablog-quarkslab-com-snapshotting-our-way-to-cve-2026-9539-html.md
- E2: https://bugbountylibrary.com/r/h1%3A160294.md
- E3: https://bugbountylibrary.com/r/h1%3A134880.md