From 0dc323e85311431919e0d590c98ef7dd30352348 Mon Sep 17 00:00:00 2001
From: Lucia <lucia.wang@harmoney.co.nz>
Date: Sat, 8 Nov 2025 14:22:03 +1300
Subject: [PATCH] prevent integer underflow in ReadAllHashesInRange

---
 core/rawdb/accessors_chain.go | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/core/rawdb/accessors_chain.go b/core/rawdb/accessors_chain.go
index f20d675ff83e..ada110554000 100644
--- a/core/rawdb/accessors_chain.go
+++ b/core/rawdb/accessors_chain.go
@@ -20,6 +20,7 @@ import (
 	"bytes"
 	"encoding/binary"
 	"fmt"
+	"math"
 	"math/big"
 	"slices"
 
@@ -87,10 +88,21 @@ type NumberHash struct {
 // heights, both canonical and reorged forks included.
 // This method considers both limits to be _inclusive_.
 func ReadAllHashesInRange(db ethdb.Iteratee, first, last uint64) []*NumberHash {
+	// Return empty result for inverted ranges
+	if last < first {
+		return nil
+	}
+	rangeLen := last - first
+	var capHint int
+	if rangeLen >= uint64(math.MaxInt) {
+		capHint = math.MaxInt
+	} else {
+		capHint = int(rangeLen) + 1
+	}
 	var (
 		start     = encodeBlockNumber(first)
 		keyLength = len(headerPrefix) + 8 + 32
-		hashes    = make([]*NumberHash, 0, 1+last-first)
+		hashes    = make([]*NumberHash, 0, capHint)
 		it        = db.NewIterator(headerPrefix, start)
 	)
 	defer it.Release()