fix(libgraphmatch): cap node ID at 16M to prevent OOM DoS in add_node

add_node(UINT32_MAX, ...) would resize internal vectors to 4GB+,
crashing the process. Added MAX_NODE_ID = 16M (≈64MB for type+score
arrays). IDs at or above the limit are silently rejected, matching the
existing drop semantics for out-of-range edges in finalize().

Two new tests pin the boundary: MAX_NODE_ID rejected, MAX_NODE_ID-1
accepted. All 33 test cases pass (79 assertions).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: lsotomayorb4

libgraphmatch/include/graphmatch/csr_graph.hpp

@@ -88,8 +88,16 @@ class CSRTemporalGraph {
 
     // -- Builder API (before finalize) ------------------------------------
 
-    /// Add a node with the given type. Duplicate IDs are ignored.
+    /// Maximum node ID accepted by add_node(). Prevents OOM from a single
+    /// malicious or buggy call (e.g. add_node(UINT32_MAX, ...) would try to
+    /// allocate >4 GB). 16M nodes ≈ 64 MB for the type+score arrays — a
+    /// reasonable ceiling for a single CSR graph. Raise if needed.
+    static constexpr NodeId MAX_NODE_ID = 16'000'000;
+
+    /// Add a node with the given type. IDs above MAX_NODE_ID are silently
+    /// rejected (same drop semantics as out-of-range edges in finalize).
     void add_node(NodeId id, EntityTypeTag type) {
+        if (id >= MAX_NODE_ID) return;
         if (id >= node_types_.size()) {
             node_types_.resize(id + 1, GM_ENTITY_ANY);
             node_scores_.resize(id + 1, 0.0f);
@@ -101,7 +109,8 @@ class CSRTemporalGraph {
         if (id >= node_count_) node_count_ = id + 1;
     }
 
-    /// Add a directed temporal edge.
+    /// Add a directed temporal edge. Edges referencing nodes above
+    /// MAX_NODE_ID will be dropped during finalize().
     void add_edge(NodeId src, NodeId dst, RelTypeTag rel_type, Timestamp ts) {
         pending_edges_.push_back({src, dst, rel_type, ts});
     }

libgraphmatch/tests/test_csr_graph.cpp

@@ -470,4 +470,26 @@ TEST_CASE("out-of-range edges do not crash empty graph") {
     CHECK(g.is_finalized());
 }
 
+TEST_CASE("add_node above MAX_NODE_ID is silently rejected") {
+    CSRTemporalGraph g;
+    g.add_node(0, GM_ENTITY_IP);
+    // Attempt to add a node with an absurd ID — must NOT allocate 4 GB+
+    g.add_node(CSRTemporalGraph::MAX_NODE_ID, GM_ENTITY_HOST);      // at limit — rejected
+    g.add_node(CSRTemporalGraph::MAX_NODE_ID + 1, GM_ENTITY_USER);  // above limit — rejected
+    g.add_node(UINT32_MAX, GM_ENTITY_HOST);                         // worst case — rejected
+    g.finalize();
+
+    CHECK(g.node_count() == 1);   // only node 0 was accepted
+    CHECK(g.node_type(0) == GM_ENTITY_IP);
+}
+
+TEST_CASE("add_node just below MAX_NODE_ID is accepted") {
+    CSRTemporalGraph g;
+    g.add_node(CSRTemporalGraph::MAX_NODE_ID - 1, GM_ENTITY_FILE);
+    g.finalize();
+
+    CHECK(g.node_count() == CSRTemporalGraph::MAX_NODE_ID);
+    CHECK(g.node_type(CSRTemporalGraph::MAX_NODE_ID - 1) == GM_ENTITY_FILE);
+}
+
 } // TEST_SUITE add_edge_boundary