# Unvalidated length in metadata parsers

Attacker-controlled length or tag fields reaching allocation, indexing, or copy without bounds checks

_Area: Memory corruption and native code. Seen in 3 disclosed reports; latest 2026-10-21. Updated 2026-10-24._

## How it works
A parser reads a length, count, or tag identifier from untrusted metadata and trusts it. The value is then used to size a buffer, advance a pointer, or select how a variadic call is interpreted, without being checked against the actual bytes available or the library's real expectations. The assumption that breaks: that the metadata describes the data it accompanies, and that the parser's own notion of a field matches how the underlying library will consume it. When either assumption is false, reads or writes land outside the intended buffer.

## Where it shows up
- Length/count fields from file headers (TIFF tags, EXIF IFD entries, MakerNote sub-IFDs) passed to allocation or copy routines.
- Pointer arithmetic of the form `base + length` compared against an end pointer, especially on 32-bit where it can wrap.
- Variadic C APIs (e.g. TIFFSetField) where the caller infers argument shape from its own value types rather than the library's effective field definition.
- Vendor-defined sub-structures (MakerNote) with offsets/lengths that are rarely validated.
- Returned offset/position fields that can turn a blind out-of-bounds scan into a disclosure oracle.

## How to review
For every length or tag value taken from input, check the invariant: the value must be validated against the actual remaining buffer size before any allocation, index, or copy, and pointer+length arithmetic must be proven not to wrap. For variadic wrappers, confirm the calling convention is queried from the library after registration (TIFFFindField, TIFFFieldPassCount, TIFFFieldWriteCount) rather than assumed from local types [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-xvh5-g6gv-559v.md). Trace each branch of a length-handling function to the actual read/write primitive (memchr, bm_search, _estrndup) and confirm bounds hold on every path [E2](https://bugbountylibrary.com/r/h1%3A144482.md)[E3](https://bugbountylibrary.com/r/h1%3A384214.md).

## Variants seen
- Calling-convention mismatch: encoder picks varargs from Python value shape; libtiff reads per its built-in field table, leaking memory or segfaulting [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-xvh5-g6gv-559v.md).
- Integer overflow in pointer arithmetic: `s + limit` wraps on 32-bit, end pointer points to unrelated memory, scan reads OOB [E2](https://bugbountylibrary.com/r/h1%3A144482.md).
- Unvalidated length in MakerNote IFD tag passed to copy routine, causing heap OOB read [E3](https://bugbountylibrary.com/r/h1%3A384214.md).

## Impact and severity
Memory disclosure (process memory, potentially secrets such as private keys) [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-xvh5-g6gv-559v.md)[E2](https://bugbountylibrary.com/r/h1%3A144482.md), segfaults/denial of service [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-xvh5-g6gv-559v.md), and heap out-of-bounds reads with potential remote code execution [E3](https://bugbountylibrary.com/r/h1%3A384214.md). Severity rises when the leaked region is reachable by an attacker-controlled offset, turning a crash into a disclosure oracle [E2](https://bugbountylibrary.com/r/h1%3A144482.md), and when the parser runs on untrusted files by default (image libraries, EXIF in web apps) [E3](https://bugbountylibrary.com/r/h1%3A384214.md).

## Evidence
- E1: https://bugbountylibrary.com/r/ghsa%3AGHSA-xvh5-g6gv-559v.md
- E2: https://bugbountylibrary.com/r/h1%3A144482.md
- E3: https://bugbountylibrary.com/r/h1%3A384214.md