#35990 wallet: harden the read-only BDB parser against crafted files

• Prevent crafted or corrupted legacy wallet files from hanging bitcoind or crashing it via out-of-memory errors
• Protect users migrating old BDB wallets from malformed inputs

This pull request hardens the read-only BDB parser in `src/wallet/migrate.cpp` against three types of malformed wallet files: revisited btree pages causing exponential DFS, circular chains of empty overflow pages causing infinite loops, and overlapping record indices leading to unbounded memory allocation. It adds visited page tracking for btree and overflow traversals, enforces that total record sizes do not exceed page size, and adds unit tests that hand-craft raw BDB pages.

Problem: When running `migratewallet` or loading legacy `.dat` files, crafted or corrupted BDB files can bypass earlier hardening checks in #34959, causing bitcoind to hang indefinitely or crash from out-of-memory exhaustion.

P3 · DoS protection

• P3 because it fixes three distinct infinite-loop and out-of-memory crash bugs when parsing malformed files
• Parsing untrusted local wallet files during migration is an infrequent vector rather than a network threat

It fixes three concrete infinite-loop and OOM denial-of-service vulnerabilities when parsing attacker-crafted or corrupted wallet files. However, the threat model involves parsing untrusted local wallet files during migration, which is an infrequent vector rather than an immediate network risk.

Membership: Changes `src/wallet/migrate.cpp` and adds wallet database unit tests for legacy BDB loading.

Factors: security/stability 2, bug 2, performance 0, user value 1, leverage 0

• Ready for review
• Small diff with passing CI and no conflicts

The PR is small, CI is passing, there are no merge conflicts, and no open review comments need to be addressed.

Author status: active, silent since 2026-08-17 after force-pushing updates

• No reviews or comments on the pull request yet
• Awaiting initial review from wallet maintainers

No reviews or comments yet

The PR has received no comments or reviews since it was submitted.

Review verdicts (DrahtBot): 0

179 lines under test/bench/ci.

• src/wallet/test/db_tests.cpp +175/-0
• src/wallet/migrate.cpp +47/-7
• src/wallet/test/fuzz/wallet_bdb_parser.cpp +4/-0

This PR hardens the read-only BDB parser used in wallet migration against crafted or corrupted files that trigger unbounded CPU usage or out-of-memory crashes. It fixes three distinct edge cases: exponential traversal across shared btree subtrees, infinite loops through cycles of empty overflow pages, and record index duplication that blows up memory usage. The changes track visited pages and bound page record sizes, accompanied by tests that construct raw BDB byte layouts. The PR has had no reviewer interaction since being opened.