# Unbounded copy into fixed buffer

Copies into fixed-size buffers where input length is never checked against destination capacity

_Area: Network devices and IoT. Seen in 4 disclosed reports; one confirmed bounty: $40,000; latest 2025-02-12. Updated 2026-10-23._

## How it works
A value the attacker controls (a query parameter, a username, a declared length field) is copied into a buffer whose size is fixed at compile time. The code assumes the input fits, or that an earlier check already limited it. When the input is longer, the copy writes past the buffer into whatever sits next to it: stack locals, adjacent globals, or a neighboring heap allocation. The overflow is not just a crash; it can overwrite state the program later trusts. A related shape is a length field that is never compared to the buffer it describes, so a parser reads past its input into adjacent memory [E3](https://bugbountylibrary.com/r/h1%3A687887.md).

## Where it shows up
- `strcpy`/`strncpy`/`memcpy` into a fixed-size array where the length argument is the input length, not the destination size [E1](https://bugbountylibrary.com/r/blog%3Azerodayinitiative-com-blog-2023-4-19-cve-2022-29844-a-classic-buffer-overflow-on-the-western-digital-my-cloud-pro-series.md)[E2](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-finding-and-exploiting-citrix-netscaler-buffer-overflow-cve-2023-3519-part-3.md)
- Pre-auth endpoints that decode a parameter before any authentication check [E2](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-finding-and-exploiting-citrix-netscaler-buffer-overflow-cve-2023-3519-part-3.md)
- A declared length or chunk-size field used to drive a copy or parse without being compared to the buffer size [E3](https://bugbountylibrary.com/r/h1%3A687887.md)
- Vendor patches to open-source daemons that add custom copies into `.bss` globals [E1](https://bugbountylibrary.com/r/blog%3Azerodayinitiative-com-blog-2023-4-19-cve-2022-29844-a-classic-buffer-overflow-on-the-western-digital-my-cloud-pro-series.md)

## How to review
For every copy, find the destination size and the maximum possible source length, and confirm a check ties them together on the same path. The invariant: before any copy, `source_length <= destination_capacity`, enforced at the copy site, not assumed from upstream. Check what is adjacent to the buffer: auth flags, path globals, or the parser's own output buffer make an overflow far more dangerous [E1](https://bugbountylibrary.com/r/blog%3Azerodayinitiative-com-blog-2023-4-19-cve-2022-29844-a-classic-buffer-overflow-on-the-western-digital-my-cloud-pro-series.md)[E3](https://bugbountylibrary.com/r/h1%3A687887.md). For protocol-driven sizes, confirm the size assumption is guaranteed by the spec, not just typical server behavior.

## Variants seen
- Unbounded `strncpy` of username into a 2048-byte global, overwriting adjacent auth and ACL flags [E1](https://bugbountylibrary.com/r/blog%3Azerodayinitiative-com-blog-2023-4-19-cve-2022-29844-a-classic-buffer-overflow-on-the-western-digital-my-cloud-pro-series.md)
- Unbounded query value into a 168-byte stack buffer on an unauthenticated endpoint; the fix added a 0x80 length check [E2](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-finding-and-exploiting-citrix-netscaler-buffer-overflow-cve-2023-3519-part-3.md)
- Unvalidated compressed chunk size letting a parser read past its input into its own output buffer, overflowing the heap [E3](https://bugbountylibrary.com/r/h1%3A687887.md)

## Why fixes fail
E1 shows vendor patches diverging from upstream in ways that add new unsafe copies. E2's fix is a single length check on one path; reviewers should confirm it covers every caller of the decode routine.

## Impact and severity
Ranged from auth and ACL bypass with root RCE [E1](https://bugbountylibrary.com/r/blog%3Azerodayinitiative-com-blog-2023-4-19-cve-2022-29844-a-classic-buffer-overflow-on-the-western-digital-my-cloud-pro-series.md) to pre-auth auth-bypass-to-root-RCE [E2](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-finding-and-exploiting-citrix-netscaler-buffer-overflow-cve-2023-3519-part-3.md) and heap overflow with userland RCE [E3](https://bugbountylibrary.com/r/h1%3A687887.md). Severity rises when the endpoint is pre-auth and the overflow lands next to trusted state.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Azerodayinitiative-com-blog-2023-4-19-cve-2022-29844-a-classic-buffer-overflow-on-the-western-digital-my-cloud-pro-series.md
- E2: https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-finding-and-exploiting-citrix-netscaler-buffer-overflow-cve-2023-3519-part-3.md
- E3: https://bugbountylibrary.com/r/h1%3A687887.md