bug(sql): paging offset int overflow throws or silently returns first page

[Aias00]

Description

DefaultSQLExecutor.executeSQL/executeSQLStreaming compute Integer offset = (pageNo - 1) * pageSize using int arithmetic with no bounds validation. pageNo/pageSize are client-controlled Integer (only the AI/MCP tool path clamps via normalizePageSize; the main execution path does not). A large pageNo (e.g. > ~2.1M with default pageSize 1000) wraps the int to a small or negative value: setMaxRows(negative) throws SQLException (500); setMaxRows(smallPositive) silently caps the result set and generateDataList skips offset rows, returning first-page data for a huge page number with no error.

Location

chat2db-community-spi/.../DefaultSQLExecutor.java:836-838 (executeSQL), :913-915 (executeSQLStreaming); :247-249/:1001-1003/:1081-1085 (stmt.setMaxRows(offset + count)). MAX_PAGE_SIZE = 1000 is a default, not an input cap.

Impact

Large/buggy page numbers cause either a 500 or silently wrong (first-page) results with no indication.

Suggested fix

Clamp pageNo >= 1, pageSize to [1, MAX_PAGE_SIZE], and pageNo to <= Integer.MAX_VALUE / pageSize so (pageNo - 1) * pageSize (and offset + count) fit in int — preventing both the negative-setMaxRows throw and the silent wrong-page return.

Related existing

None.

[github-actions]

Thanks for the precise report. The described overflow in DefaultSQLExecutor.executeSQL and executeSQLStreaming, including the large-pageNo reproduction and both observed failure modes, gives maintainers a concrete code path to assess; the linked #2433 is also available for review.

The current bug form still requires the Chat2DB edition and version or source commit, deployment type, operating system and version, impact category, workaround status, and submission confirmations. Please add those details, with the version or commit SHA as the most useful next step so maintainers can establish the affected baseline.

``

Generated by AI Issue Assistant for #2432 · 6.46 AIC · ⌖ 0.705 AIC · ⊞ 16K · ◷