Skip to content

Bound scan checkpoint reads before deserialization #2856

Description

@Widthdom

Problem

src/CodeIndex/Cli/IndexCommandRunner.FullScan.cs loads the scan checkpoint with File.ReadAllText and immediately deserializes it as JSON.

Impact

A corrupt or very large checkpoint under .cdidx can force large allocations before the indexer has a chance to reject it, slowing or crashing an index start.

Expected

Check the checkpoint file length before reading, cap the accepted payload size, and treat oversized or invalid checkpoints as recoverable stale state.

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions