{"record":{"id":"c0456a3b17cf5d3d","repo":"tursodatabase/turso","slug":"buffer-too-short-for-u64-at-offset-offset","errorCode":null,"errorMessage":"buffer too short for u64 at offset {offset}","messagePattern":"buffer too short for u64 at offset (.+?)","errorType":"validation","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"cli/sync_server.rs","lineNumber":1113,"sourceCode":"    if end_magic != MVCC_TX_END_MAGIC {\n        return Err(anyhow!(\n            \"invalid MVCC logical log frame end magic at offset {offset}\"\n        ));\n    }\n    Ok(Some((frame_end, stored_crc)))\n}\n\nfn read_u32_le(buf: &[u8], offset: usize) -> Result<u32> {\n    let bytes = buf\n        .get(offset..offset + 4)\n        .ok_or_else(|| anyhow!(\"buffer too short for u32 at offset {offset}\"))?;\n    Ok(u32::from_le_bytes(bytes.try_into().unwrap()))\n}\n\nfn read_u64_le(buf: &[u8], offset: usize) -> Result<u64> {\n    let bytes = buf\n        .get(offset..offset + 8)\n        .ok_or_else(|| anyhow!(\"buffer too short for u64 at offset {offset}\"))?;\n    Ok(u64::from_le_bytes(bytes.try_into().unwrap()))\n}\n\nfn current_db_size_pages(conn: &Connection, max_frame: u64) -> Result<u64> {\n    if max_frame > 0 {\n        let frame_size = WAL_FRAME_HEADER_SIZE + PAGE_SIZE;\n        let mut last_frame = vec![0u8; frame_size];\n        let last_info = conn.wal_get_frame(max_frame, &mut last_frame)?;\n        Ok(last_info.db_size as u64)\n    } else {\n        Ok(0)\n    }\n}\n\nfn current_snapshot_db_size_pages(conn: &Connection, max_frame: u64) -> Result<u64> {\n    if max_frame > 0 {\n        return current_db_size_pages(conn, max_frame);\n    }","sourceCodeStart":1095,"sourceCodeEnd":1131,"githubUrl":"https://github.com/tursodatabase/turso/blob/bad083fafbefdeae9a42ec19bdaaad8918dcf411/cli/sync_server.rs#L1095-L1131","documentation":"The u64 counterpart of read_u32_le: 8 little-endian bytes at offset..offset+8 must lie inside the buffer or this error returns. It backs every multi-byte field read in the MVCC log scanner (payload size, extension size, salt). Reaching it via scan_mvcc_log means a length invariant broke; reaching it in new code means the caller skipped a bounds check.","triggerScenarios":"read_u64_le(buf, offset) with fewer than 8 bytes remaining at offset — same shape as the u32 helper: unchecked callers, refactors that removed size pre-checks, or off-by-one offset arithmetic.","commonSituations":"New code reading 8-byte length fields from short buffers; fuzzed truncated inputs; refactors that changed frame-layout constants without updating bounds checks.","solutions":["Check buf.len() >= offset + 8 before calling read_u64_le.","Use offset.checked_add(8) to also rule out offset overflow.","If it fires inside the scanner proper, treat it as a regression and report the log plus offsets."],"exampleFix":"// before\nlet size = read_u64_le(buf, offset)?; // may error: buffer too short for u64\n\n// after\nanyhow::ensure!(\n    offset.checked_add(8).is_some_and(|end| end <= buf.len()),\n    \"no room for u64 at offset {offset}\"\n);\nlet size = read_u64_le(buf, offset)?;","handlingStrategy":"validation","validationCode":"fn has_u64_at(buf: &[u8], offset: usize) -> bool {\n    offset.checked_add(8).is_some_and(|end| end <= buf.len())\n}\n// before reading:\nanyhow::ensure!(has_u64_at(buf, offset), \"no room for u64 at offset {offset}\");\nlet value = read_u64_le(buf, offset)?;","typeGuard":"fn has_u64_at(buf: &[u8], offset: usize) -> bool {\n    offset.checked_add(8).is_some_and(|end| end <= buf.len())\n}","tryCatchPattern":"match read_u64_le(buf, offset) {\n    Ok(value) => { /* use value */ }\n    Err(err) if err.to_string().contains(\"buffer too short for u64\") => {\n        // caller bug: add the missing bounds check at this call site\n    }\n    Err(err) => return Err(err),\n}","preventionTips":["Bound-check offset+8 before reading u64 length fields.","When layout constants change, re-audit every read's size pre-check.","Fuzz new parsers with truncated buffers to flush missing checks."],"tags":["bounds-check","parsing","rust","offset"],"backgroundTag":"index-out-of-bounds","analyzedSha":"bad083fafbefdeae9a42ec19bdaaad8918dcf411","analyzedAt":"2026-08-16T23:12:11.798Z","schemaVersion":2},"datasetVersion":"2026-08-17T04:17:16.089Z"}