State WAL replacement#3701
Open
cody-littley wants to merge 33 commits into
Open
Claude / Claude Code Review
completed
Jul 6, 2026 in 34m 35s
Code review found 1 potential issue
Found 1 candidates, confirmed 1. See review comments for details.
Details
| Severity | Count |
|---|---|
| 🔴 Important | 0 |
| 🟡 Nit | 1 |
| 🟣 Pre-existing | 0 |
| Severity | File:Line | Issue |
|---|---|---|
| 🟡 Nit | sei-db/statewal/state_wal_entry.go:130 |
Unbounded allocation in DeserializeEntry from uvarint count |
Annotations
Check warning on line 130 in sei-db/statewal/state_wal_entry.go
claude / Claude Code Review
Unbounded allocation in DeserializeEntry from uvarint count
In `DeserializeEntry` (state_wal_entry.go:130), the changeset `count` is decoded as an unvalidated uvarint and passed directly to `make([]*proto.NamedChangeSet, 0, count)`. If a corrupt payload somehow survives the CRC32 check with a huge `count`, this panics with "makeslice: cap out of range" (or OOMs), crashing the process — the callers (recovery, iterator reader goroutine, rollback) don't recover. A one-line bound (`if count > uint64(len(rest)) { return nil, false, nil }`) would mirror the ex
Loading