{"record":{"id":"175a8aadcf05dcbf","repo":"nats-io/nats-server","slug":"snapshot-message-bytes-exceed-reserved-restore-siz","errorCode":null,"errorMessage":"snapshot message bytes exceed reserved restore size","messagePattern":"snapshot message bytes exceed reserved restore size","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/stream_backup.go","lineNumber":492,"sourceCode":"\t\tif hdr.HeaderSize < 0 || hdr.PayloadSize < 0 || hdr.PayloadSize > math.MaxInt64-hdr.HeaderSize {\n\t\t\treturn nil, fmt.Errorf(\"invalid message lengths for sequence %d\", seq)\n\t\t}\n\t\tdeclaredSize := hdr.HeaderSize + hdr.PayloadSize\n\t\tif hdr.HeaderSize > mp || hdr.PayloadSize > mp-hdr.HeaderSize {\n\t\t\treturn nil, fmt.Errorf(\"message sequence %d exceeds maximum payload size\", seq)\n\t\t}\n\t\tif mms := int64(cfg.MaxMsgSize); mms >= 0 && (hdr.HeaderSize > mms || hdr.PayloadSize > mms-hdr.HeaderSize) {\n\t\t\treturn nil, fmt.Errorf(\"message sequence %d exceeds maximum message size\", seq)\n\t\t}\n\t\tvar storedSizeRaw uint64\n\t\tswitch cfg.Storage {\n\t\tcase MemoryStorage:\n\t\t\tstoredSizeRaw = memStoreMsgSizeRaw(len(hdr.Name), int(hdr.HeaderSize), int(hdr.PayloadSize))\n\t\tdefault:\n\t\t\tstoredSizeRaw = fileStoreMsgSizeRaw(len(hdr.Name), int(hdr.HeaderSize), int(hdr.PayloadSize))\n\t\t}\n\t\tif storedSizeRaw > math.MaxInt64 {\n\t\t\treturn nil, fmt.Errorf(\"snapshot message bytes exceed reserved restore size\")\n\t\t}\n\t\tstoredSize := int64(storedSizeRaw)\n\t\tif additional := storedSize - restoreRemaining; additional > 0 {\n\t\t\tjsa.updateUsage(tier, cfg.Storage, additional)\n\t\t\trestoreRemaining += additional\n\t\t\tif err := checkUsageLimits(); err != nil {\n\t\t\t\treturn nil, err\n\t\t\t}\n\t\t}\n\t\tbuf, err := io.ReadAll(tr)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to read message sequence %d: %w\", seq, err)\n\t\t}\n\t\tif hdr.HeaderSize > int64(len(buf)) {\n\t\t\treturn nil, fmt.Errorf(\"failed to parse message sequence %d: invalid header length\", seq)\n\t\t}\n\t\tif int64(len(buf)) != declaredSize {\n\t\t\treturn nil, fmt.Errorf(\"failed to read message sequence %d: unexpected payload size\", seq)","sourceCodeStart":474,"sourceCodeEnd":510,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/stream_backup.go#L474-L510","documentation":"Validation guard during restore: the computed on-disk stored size for the message (derived from subject length, header size, and payload size for the storage backend) overflows int64 when cast from its unsigned raw computation. This is a defensive arithmetic-overflow check that fires only for absurd header values, i.e. a corrupt or crafted archive.","triggerScenarios":"Thrown at server/stream_backup.go:492 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Regenerate the backup archive; stored-size overflow implies corrupted length fields in the current one","Verify the archive was produced by a compatible official server version","Validate header/payload lengths of archive entries before restore if importing external data"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}