[uk-ai-resilience] [security] Fix allocation-size-overflow in compiler_model_pricing.go (CodeQL HIGH #638, CWE-190)

[github-actions]

Summary

CodeQL HIGH alert #638 (created 2026-07-03, today) flags an allocation-size-overflow in the workflow compiler's model-pricing module.

File: pkg/workflow/compiler_model_pricing.go line 166
Rule: go/allocation-size-overflow (CWE-190 — integer overflow)
Severity: HIGH

Tier & Risk Scoring

Dimension	Score	Notes
Exposure amplification	3	Compiler processes all workflow definitions; overflow could panic or corrupt pricing
Patchability	1	One-line bounds check or safe arithmetic
Detectability	4	Silent overflow produces wrong allocation size; no runtime warning
Operational fragility	3	Runtime panic or incorrect buffer could affect all compiled workflows
Ownership confidence	4	Active compiler team with fast turnaround
Aggregate	15	Tier B — Open With Conditions

SLA: High — fix within 7 days.

Root Cause

pkg/workflow/compiler_model_pricing.go:166 performs an arithmetic operation on a potentially large value used in an allocation. If the intermediate result overflows the signed int type, the allocation will receive a negative size, causing a runtime panic.

Recommended Fix

Add an upper-bound guard before the make() call:

// Option A — validate input size before arithmetic
const maxSafeLen = 64 * 1024 * 1024 // 64 MB
if len(data) > maxSafeLen {
    return nil, fmt.Errorf("input too large: %d bytes", len(data))
}
size := len(data) + (len(data) % 16)
buffer := make([]byte, size)

Or use a wider type to prevent overflow:

size := uint64(len(data)) + uint64(len(data)%16)
if size > math.MaxInt {
    return nil, fmt.Errorf("computed size overflows int")
}
buffer := make([]byte, int(size))

Governance Context

Identified by the UK AI Open Code Risk & Resilience Governance scan (2026-07-03). See discussion report for full tier classification and remediation queue.

References: CodeQL alert #638 · run 28671336499

Generated by UK AI Operational Resilience · 91.2 AIC · ⌖ 8.39 AIC · ⊞ 5.2K · ◷