Summary
Database path resolution reads checksum sample files into memory without bounding the file size first.
Evidence
In src/CodeIndex/Cli/DbPathResolver.cs, CountMatchingSamples computes FileIndexer.ComputeChecksum(File.ReadAllBytes(ioPath)) for sample paths stored in the candidate DB. There is no size check before ReadAllBytes.
Impact
A stale or malicious DB can make the resolver allocate very large files during candidate matching. This can turn automatic DB discovery into an avoidable memory/latency failure.
Suggested fix
Use a bounded streaming checksum helper, or skip samples above the indexer's normal maximum indexed file size. Add a regression test with an oversized sample path.
Summary
Database path resolution reads checksum sample files into memory without bounding the file size first.
Evidence
In
src/CodeIndex/Cli/DbPathResolver.cs,CountMatchingSamplescomputesFileIndexer.ComputeChecksum(File.ReadAllBytes(ioPath))for sample paths stored in the candidate DB. There is no size check beforeReadAllBytes.Impact
A stale or malicious DB can make the resolver allocate very large files during candidate matching. This can turn automatic DB discovery into an avoidable memory/latency failure.
Suggested fix
Use a bounded streaming checksum helper, or skip samples above the indexer's normal maximum indexed file size. Add a regression test with an oversized sample path.