CRITICAL: Tuple count truncated to uint16_t on serialization #143

Why is this an issue?

In src/storage/heap_table.cpp:189:

uint16_t num_values = static_cast<uint16_t>(tuple.size());

If tuple.size() > 65535, truncation causes data corruption.

What is causing it?

No bounds check before truncation.

How can it be solved?

Return error if tuple exceeds uint16_t max.

Category

• Small
• Medium
• Large
• Critical

Severity

• Low
• Medium
• High
• Critical