NRG: Avoid panic on corrupted TAV file (#5464)

If the file ends up truncated somehow then we should not try to call
`Uint64`, otherwise it will result in an out-of-bounds panic.

Signed-off-by: Neil Twigg <neil@nats.io>

server/raft.go

@@ -3735,7 +3735,8 @@ func readPeerState(sd string) (ps *peerState, err error) {
 }
 
 const termVoteFile = "tav.idx"
-const termVoteLen = idLen + 8
+const termLen = 8 // uint64
+const termVoteLen = idLen + termLen
 
 // Writes out our term & vote outside of a specific raft context.
 func writeTermVote(sd string, wtv []byte) error {
@@ -3761,6 +3762,10 @@ func (n *raft) readTermVote() (term uint64, voted string, err error) {
 	if err != nil {
 		return 0, noVote, err
 	}
+	if len(buf) < termLen {
+		// Not enough bytes for the uint64 below, so avoid a panic.
+		return 0, noVote, nil
+	}
 	var le = binary.LittleEndian
 	term = le.Uint64(buf[0:])
 	if len(buf) < termVoteLen {

server/raft_test.go

@@ -16,6 +16,8 @@ package server
 import (
 	"math"
 	"math/rand"
+	"os"
+	"path/filepath"
 	"testing"
 	"time"
 
@@ -405,3 +407,24 @@ func TestNRGUnsuccessfulVoteRequestDoesntResetElectionTimer(t *testing.T) {
 	require_True(t, leaderOriginal.Equal(leader.etlr))
 	require_True(t, followerOriginal.Equal(follower.etlr))
 }
+
+func TestNRGInvalidTAVDoesntPanic(t *testing.T) {
+	c := createJetStreamClusterExplicit(t, "R3S", 3)
+	defer c.shutdown()
+	c.waitOnLeader()
+
+	rg := c.createRaftGroup("TEST", 3, newStateAdder)
+	rg.waitOnLeader()
+
+	// Mangle the TAV file to a short length (less than uint64).
+	leader := rg.leader()
+	tav := filepath.Join(leader.node().(*raft).sd, termVoteFile)
+	require_NoError(t, os.WriteFile(tav, []byte{1, 2, 3, 4}, 0644))
+
+	// Restart the node.
+	leader.stop()
+	leader.restart()
+
+	// Before the fix, a crash would have happened before this point.
+	c.waitOnAllCurrent()
+}