wallet: bound-check shachain_known pos on load

What changed, and why it matters

This update fixes a bug in Core Lightning's wallet code where it reads a 'position' value from its database and uses it directly as an array index without first checking whether it is valid. If the database contained an out-of-range value, the program could read or write memory outside the intended array, which can cause crashes or unpredictable behavior. The fix adds a simple bounds check and makes the program stop with a clear error if the value is invalid.

Security signals we found

Evidence from the diff

Changed components

### wallet/wallet.c
@@ -1255,6 +1255,9 @@ static bool wallet_shachain_load(struct wallet *wallet, u64 id,
 
 	while (db_step(stmt)) {
 		int pos = db_col_int(stmt, "pos");
+		if (pos < 0 || pos >= ARRAY_SIZE(chain->chain.known))
+			db_fatal(wallet->db,
+				 "shachain_known pos %i out of range", pos);
 		chain->chain.known[pos].index = db_col_u64(stmt, "idx");
 		db_col_sha256(stmt, "hash", &chain->chain.known[pos].hash);
 	}