# Trusted length field drives copy

Wire length or offset used as copy size or pointer advance without a bound against the destination

_Area: Network devices and IoT. Seen in 19 disclosed reports; 11 confirmed bounties, median $5,000, range $500-$105,000; latest 2026-10-15. Updated 2026-10-23._

## How it works
A parser reads a length (or offset+size) from untrusted input — a packet field, a protocol attribute, a binary blob inside SOAP — and uses it as the copy size (memcpy, memmove, strcat) or to advance a write pointer. The code assumes the number describes data that fits the destination. Nothing ties the attacker-supplied value to the actual allocation or stack frame, so the write lands past the buffer. The assumption that breaks: "the peer's length is consistent with our buffer." It is never checked, so it never holds.

## Where it shows up
- Decode handlers copying length-prefixed fields into fixed inline struct members; a 1-byte length is still enough to overflow [E1](https://bugbountylibrary.com/r/blog%3Asynacktiv-com-en-publications-the-printer-goes-brrrrr-html.md)[E5](https://bugbountylibrary.com/r/blog%3Athezdi-com-blog-2026-9-23-cve-2024-0244-a-heap-buffer-overflow-in-the-canon-mf753cdw-printer.md)
- Protocol fields describing struct layout (type/offset/size) consumed without validating offset+size against the allocation [E2](https://bugbountylibrary.com/r/h1%3A484745.md)
- Copy sizes summed from per-layer parsed lengths, where one layer is attacker-controlled [E6](https://bugbountylibrary.com/r/h1%3A3770768.md)
- A write offset incremented and used to advance a buffer pointer, never checked against remaining space [E4](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-two-bytes-is-plenty-fortigate-rce-with-cve-2024-21762.md)
- Canonicalization/attribute strings (e.g. SAML PrefixList) copied into a fixed global buffer with no size check [E3](https://bugbountylibrary.com/r/blog%3Alabs-watchtowr-com-youre-back-in-the-room-citrix-netscaler-pre-auth-rce-cve-2026-8452.md)
- Adjacent shape: a size computed in a wide type but stored in a narrower one, so the bound or mask derived from it collapses [E7](https://bugbountylibrary.com/r/blog%3Ablog-doyensec-com-2025-02-27-exploitable-sshd-html.md)
- Confirm the length and the destination are measured in the same units and coordinate space before trusting any comparison

## How to review
For every copy, trace the size argument to its source. The invariant: before any copy or pointer advance, `length <= destination_capacity - current_offset`, computed in the same units and coordinate space the copy uses. Check that the check sits on the same path as the copy (not a sibling branch), that arithmetic cannot underflow, and that alternate callers or allocators don't change the buffer size the check assumed. For layout-describing protocols, validate offset+size against the actual allocation at the consumer. For pointer-advance loops, confirm the offset is re-checked each iteration. For size variables, confirm the declared type holds every value the computation can produce.

## Variants seen
- Fixed inline struct buffer overflowed by 1-byte length fields [E1](https://bugbountylibrary.com/r/blog%3Asynacktiv-com-en-publications-the-printer-goes-brrrrr-html.md)[E5](https://bugbountylibrary.com/r/blog%3Athezdi-com-blog-2026-9-23-cve-2024-0244-a-heap-buffer-overflow-in-the-canon-mf753cdw-printer.md)
- Wire-supplied field_offset/field_size overflowing a stack struct [E2](https://bugbountylibrary.com/r/h1%3A484745.md)
- Summed layer lengths passed to memmove into a stack buffer [E6](https://bugbountylibrary.com/r/h1%3A3770768.md)
- Unchecked write-offset advance in chunked-trailer parsing [E4](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-two-bytes-is-plenty-fortigate-rce-with-cve-2024-21762.md)
- Oversized SAML PrefixList copied into a fixed global buffer [E3](https://bugbountylibrary.com/r/blog%3Alabs-watchtowr-com-youre-back-in-the-room-citrix-netscaler-pre-auth-rce-cve-2026-8452.md)
- Adjacent: 32-bit size truncated into a 16-bit static, collapsing a mask to all-ones [E7](https://bugbountylibrary.com/r/blog%3Ablog-doyensec-com-2025-02-27-exploitable-sshd-html.md)

## Why fixes fail
A length cap added in one place left a sibling field incremented but never bounds-checked [E4](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-two-bytes-is-plenty-fortigate-rce-with-cve-2024-21762.md). This is a single observed case; treat it as a prompt to check sibling fields, not a general rule.

## Impact and severity
Heap/stack corruption leading to pointer hijack, arbitrary free, control-flow hijack and RCE [E1](https://bugbountylibrary.com/r/blog%3Asynacktiv-com-en-publications-the-printer-goes-brrrrr-html.md)[E2](https://bugbountylibrary.com/r/h1%3A484745.md)[E3](https://bugbountylibrary.com/r/blog%3Alabs-watchtowr-com-youre-back-in-the-room-citrix-netscaler-pre-auth-rce-cve-2026-8452.md)[E4](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-two-bytes-is-plenty-fortigate-rce-with-cve-2024-21762.md)[E5](https://bugbountylibrary.com/r/blog%3Athezdi-com-blog-2026-9-23-cve-2024-0244-a-heap-buffer-overflow-in-the-canon-mf753cdw-printer.md)[E6](https://bugbountylibrary.com/r/h1%3A3770768.md). Severity rises with pre-auth reachability and allocator control enabling function-pointer overwrite [E1](https://bugbountylibrary.com/r/blog%3Asynacktiv-com-en-publications-the-printer-goes-brrrrr-html.md)[E3](https://bugbountylibrary.com/r/blog%3Alabs-watchtowr-com-youre-back-in-the-room-citrix-netscaler-pre-auth-rce-cve-2026-8452.md)[E4](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-two-bytes-is-plenty-fortigate-rce-with-cve-2024-21762.md)[E5](https://bugbountylibrary.com/r/blog%3Athezdi-com-blog-2026-9-23-cve-2024-0244-a-heap-buffer-overflow-in-the-canon-mf753cdw-printer.md). E2 is client-side (malicious server against a game client), not pre-auth server reachability.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Asynacktiv-com-en-publications-the-printer-goes-brrrrr-html.md
- E2: https://bugbountylibrary.com/r/h1%3A484745.md
- E3: https://bugbountylibrary.com/r/blog%3Alabs-watchtowr-com-youre-back-in-the-room-citrix-netscaler-pre-auth-rce-cve-2026-8452.md
- E4: https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-two-bytes-is-plenty-fortigate-rce-with-cve-2024-21762.md
- E5: https://bugbountylibrary.com/r/blog%3Athezdi-com-blog-2026-9-23-cve-2024-0244-a-heap-buffer-overflow-in-the-canon-mf753cdw-printer.md
- E6: https://bugbountylibrary.com/r/h1%3A3770768.md
- E7: https://bugbountylibrary.com/r/blog%3Ablog-doyensec-com-2025-02-27-exploitable-sshd-html.md
- E8: https://bugbountylibrary.com/r/blog%3Ablog-doyensec-com-2025-02-11-exploitable-iot-html.md