`monad_db_snapshot_loader_load` lacks capacity check before accessing storage

[guidovranken]

Description

monad_db_snapshot_loader_load does not check if storage_view contains sufficient data for extracting a uint64_t:

monad/category/execution/ethereum/db/db_snapshot.cpp

Lines 391 to 393 in 4ec3fdf

	while (!storage_view.empty()) {
	uint64_t const account_offset =
	unaligned_load<uint64_t>(storage_view.data());

whereas such a check is performed for code_view later in the function:

monad/category/execution/ethereum/db/db_snapshot.cpp

Lines 419 to 421 in 4ec3fdf

	while (!code_view.empty()) {
	MONAD_ASSERT(code_view.size() >= sizeof(uint64_t));
	uint64_t const size = unaligned_load<uint64_t>(code_view.data());

Although there is potential for an out-of-bounds read, this code is only used for loading snapshot files which can reasonably be trusted. Hence this is merely an informational finding.

In monad_db_snapshot_load_filesystem, an integrity check of the file is performed by comparing its blake3 hash against an expected hash, so local file corruption shouldn't be able to cause this.

Only if the snapshot serialization code (monad_db_snapshot_write_filesystem) would inadvertently serialize a truncated storage array this could be a problem.

Recommendation

Add MONAD_ASSERT(storage_view.size() >= sizeof(uint64_t)); before unaligned_load() for consistency and early detection of a malformed snapshot file.