Fix potential integer overflow in shortest path est (#22150)

neunhoef · web-flow · commit adce17c4bf5e · 2025-12-02T09:08:26.000+01:00
* Add runtime check for overflow.

* CHANGELOG.
diff --git a/CHANGELOG b/CHANGELOG
@@ -1,6 +1,8 @@
 devel
 -----
 
+* Fix a potential integer overflow in shortest path estimation.
+
 * Fix BTS-2268: Fixed an issue where query plan for queries with subquery
   is causing a crash when being stored in query plan cache. The issue
   is a missing invalidateCost from the splice-subqueries rule.
diff --git a/arangod/Graph/ShortestPathOptions.cpp b/arangod/Graph/ShortestPathOptions.cpp
@@ -170,7 +170,10 @@ double ShortestPathOptions::estimateCost(size_t& nrItems) const {
   // We use the "seven-degrees-of-seperation" rule.
   // This theory asumes that the shortest path is at most 7 steps of length
 
-  nrItems = static_cast<size_t>(std::pow(baseCreateItems, 7));
+  double tmp = std::pow(baseCreateItems, 7);
+  nrItems = tmp > static_cast<double>(std::numeric_limits<size_t>::max())
+                ? std::numeric_limits<size_t>::max()
+                : static_cast<size_t>(tmp);
   return std::pow(baseCost, 7);
 }
 
