Tighten integer and allocation bounds for CodeQL

internal/ai/patrol_history_persistence.go

@@ -182,6 +182,25 @@ type PatrolRunHistoryStore struct {
 	onSaveError   func(err error)
 }
 
+func clampHistoryCount(value, minValue, maxValue int) int {
+	if value < minValue {
+		return minValue
+	}
+	if value > maxValue {
+		return maxValue
+	}
+	return value
+}
+
+func normalizeHistoryRequestCount(requested, storeMax, available int) int {
+	if requested <= 0 {
+		requested = MaxPatrolRunHistory
+	}
+	requested = clampHistoryCount(requested, 0, MaxPatrolRunHistory)
+	requested = clampHistoryCount(requested, 0, storeMax)
+	return clampHistoryCount(requested, 0, available)
+}
+
 // NewPatrolRunHistoryStore creates a new patrol run history store
 func NewPatrolRunHistoryStore(maxRuns int) *PatrolRunHistoryStore {
 	if maxRuns <= 0 {
@@ -258,12 +277,7 @@ func (s *PatrolRunHistoryStore) GetRecent(n int) []PatrolRunRecord {
 	s.mu.RLock()
 	defer s.mu.RUnlock()
 
-	if n <= 0 || n > s.maxRuns {
-		n = s.maxRuns
-	}
-	if n > len(s.runs) {
-		n = len(s.runs)
-	}
+	n = normalizeHistoryRequestCount(n, s.maxRuns, len(s.runs))
 
 	result := make([]PatrolRunRecord, n)
 	copy(result, s.runs[:n])

internal/ai/proxmox/events.go

@@ -86,6 +86,25 @@ type OperationWindow struct {
 	ExpectedMetrics   []string         `json:"expected_metrics"` // Metrics expected to be affected
 }
 
+func clampCorrelationCount(value, minValue, maxValue int) int {
+	if value < minValue {
+		return minValue
+	}
+	if value > maxValue {
+		return maxValue
+	}
+	return value
+}
+
+func normalizeCorrelationLimit(requested, configMax, available int) int {
+	if requested <= 0 {
+		requested = DefaultEventCorrelatorConfig().MaxCorrelations
+	}
+	requested = clampCorrelationCount(requested, 0, DefaultEventCorrelatorConfig().MaxCorrelations)
+	requested = clampCorrelationCount(requested, 0, configMax)
+	return clampCorrelationCount(requested, 0, available)
+}
+
 // EventCorrelatorConfig configures the event correlator
 type EventCorrelatorConfig struct {
 	DataDir           string
@@ -403,12 +422,7 @@ func (c *EventCorrelator) GetCorrelations(limit int) []EventCorrelation {
 	c.mu.RLock()
 	defer c.mu.RUnlock()
 
-	if limit <= 0 || limit > c.config.MaxCorrelations {
-		limit = c.config.MaxCorrelations
-	}
-	if limit > len(c.correlations) {
-		limit = len(c.correlations)
-	}
+	limit = normalizeCorrelationLimit(limit, c.config.MaxCorrelations, len(c.correlations))
 
 	// Return most recent
 	start := len(c.correlations) - limit

internal/mock/generator.go

@@ -662,12 +662,13 @@ func ptrFloat64(v float64) *float64 {
 }
 
 func generateNodes(config MockConfig) []models.Node {
-	nodes := make([]models.Node, 0, config.NodeCount)
+	nodeCount := clampInt(config.NodeCount, 0, maxMockNodeCount)
+	nodes := make([]models.Node, 0, nodeCount)
 
 	// First 5 nodes are part of the cluster
 	clusterNodeCount := 5
-	if config.NodeCount < 5 {
-		clusterNodeCount = config.NodeCount
+	if nodeCount < 5 {
+		clusterNodeCount = nodeCount
 	}
 
 	// Generate clustered nodes
@@ -714,7 +715,7 @@ func generateNodes(config MockConfig) []models.Node {
 	}
 
 	// Generate standalone nodes (if we have more than 5 nodes)
-	for i := clusterNodeCount; i < config.NodeCount; i++ {
+	for i := clusterNodeCount; i < nodeCount; i++ {
 		nodeName := fmt.Sprintf("standalone%d", i-clusterNodeCount+1)
 		isHighLoad := false
 		for _, n := range config.HighLoadNodes {

pkg/proxmox/client.go

@@ -1606,8 +1606,8 @@ func (a *VMIpAddress) UnmarshalJSON(data []byte) error {
 	if prefix > 128 {
 		prefix = 128
 	}
-	if prefix <= 128 {
-		a.Prefix = int(prefix)
+	if prefixInt, ok := intFromUint64Checked(prefix); ok {
+		a.Prefix = prefixInt
 	}
 	return nil
 }

pkg/proxmox/intconv.go

@@ -1,16 +1,28 @@
 package proxmox
 
-import "math"
+import (
+	"math"
+	"strconv"
+)
 
 func intFromInt64Checked(v int64) (int, bool) {
-	if v > int64(math.MaxInt) || v < int64(math.MinInt) {
-		return 0, false
+	if strconv.IntSize == 32 {
+		if v > math.MaxInt32 || v < math.MinInt32 {
+			return 0, false
+		}
+		return int(int32(v)), true
 	}
 	return int(v), true
 }
 
 func intFromUint64Checked(v uint64) (int, bool) {
-	if v > uint64(math.MaxInt) {
+	if strconv.IntSize == 32 {
+		if v > math.MaxInt32 {
+			return 0, false
+		}
+		return int(int32(v)), true
+	}
+	if v > math.MaxInt64 {
 		return 0, false
 	}
 	return int(v), true