{"record":{"id":"66a4311508940468","repo":"tursodatabase/turso","slug":"mvcc-logical-log-frame-offset-overflow","errorCode":null,"errorMessage":"MVCC logical log frame offset overflow","messagePattern":"MVCC logical log frame offset overflow","errorType":"validation","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"cli/sync_server.rs","lineNumber":1080,"sourceCode":"        if extension_size == 0 && extension_record_count != 0 {\n            return Err(anyhow!(\n                \"MVCC logical log extension record count without extension block at offset {offset}\"\n            ));\n        }\n        if extension_size > 0 && frame_flags & MVCC_TX_FRAME_FLAG_HAS_EXTENSION_BLOCK == 0 {\n            return Err(anyhow!(\n                \"MVCC logical log extension block missing flag at offset {offset}\"\n            ));\n        }\n        extension_size\n    } else {\n        0\n    };\n    let trailer_start = offset\n        .checked_add(header_size)\n        .and_then(|value| value.checked_add(payload_size))\n        .and_then(|value| value.checked_add(extension_size))\n        .ok_or_else(|| anyhow!(\"MVCC logical log frame offset overflow\"))?;\n    let frame_end = trailer_start\n        .checked_add(MVCC_TX_TRAILER_SIZE)\n        .ok_or_else(|| anyhow!(\"MVCC logical log frame end overflow\"))?;\n    if frame_end > log.len() {\n        return Ok(None);\n    }\n    let expected_crc = crc32c::crc32c_append(running_crc, &log[offset..trailer_start]);\n    let stored_crc = read_u32_le(log, trailer_start)?;\n    if stored_crc != expected_crc {\n        return Err(anyhow!(\n            \"MVCC logical log frame checksum mismatch at offset {offset}\"\n        ));\n    }\n    let end_magic = read_u32_le(log, trailer_start + 4)?;\n    if end_magic != MVCC_TX_END_MAGIC {\n        return Err(anyhow!(\n            \"invalid MVCC logical log frame end magic at offset {offset}\"\n        ));","sourceCodeStart":1062,"sourceCodeEnd":1098,"githubUrl":"https://github.com/tursodatabase/turso/blob/bad083fafbefdeae9a42ec19bdaaad8918dcf411/cli/sync_server.rs#L1062-L1098","documentation":"The trailer offset is computed as offset + header_size + payload_size + extension_size with checked_add at every step. This error means the sum overflowed usize — reachable only when corrupted length fields carry absurd values (near u64::MAX on 64-bit, or sums >= 2^32 on 32-bit). It converts what would be silent wraparound into a clean rejection before any slicing happens.","triggerScenarios":"A frame whose payload/extension u64 fields sum with the offset past usize::MAX — corrupted or deliberately hostile length metadata; on 32-bit builds, any frame whose sizes sum to 4 GiB or more.","commonSituations":"Fuzzed or maliciously crafted log files with maximal length fields; 32-bit builds scanning logs with large length values; storage corruption striking multiple length bytes at once.","solutions":["Treat the log as corrupt or hostile and re-pull it from a known-good source.","On 32-bit targets, run a 64-bit build to eliminate the narrower overflow window.","Pre-check that payload + extension sizes are <= remaining log length before scanning."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"fn frame_sizes_within_log(log: &[u8], offset: usize, header_size: usize) -> bool {\n    let payload = log.get(offset + 4..offset + 12).map(|b| u64::from_le_bytes(b.try_into().unwrap()));\n    let ext = log.get(offset + 24..offset + 32).map(|b| u64::from_le_bytes(b.try_into().unwrap()));\n    payload.unwrap_or(0) + ext.unwrap_or(0) <= (log.len() - offset) as u64\n}","typeGuard":null,"tryCatchPattern":"match scan_mvcc_log(&log) {\n    Ok(snapshot) => { /* serve deltas */ }\n    Err(err) if err.to_string().contains(\"frame offset overflow\") => {\n        // corrupted or hostile length fields: discard and re-pull the log\n    }\n    Err(err) => return Err(err),\n}","preventionTips":["Bound parsed payload/extension sizes by the remaining log length before scanning.","Run 64-bit builds to shrink the overflow window to absurd values only.","Treat any length field larger than the file itself as corruption."],"tags":["mvcc","turso","sync","integer-overflow","defensive-check"],"backgroundTag":"untrusted-length-overflow","analyzedSha":"bad083fafbefdeae9a42ec19bdaaad8918dcf411","analyzedAt":"2026-08-16T23:12:11.798Z","schemaVersion":2},"datasetVersion":"2026-08-17T04:17:16.089Z"}