usearch 2.25.1 → 2.26.0

package/include/usearch/index.hpp

@@ -8,8 +8,8 @@
 #define UNUM_USEARCH_HPP
 
 #define USEARCH_VERSION_MAJOR 2
-#define USEARCH_VERSION_MINOR 25
-#define USEARCH_VERSION_PATCH 1
+#define USEARCH_VERSION_MINOR 26
+#define USEARCH_VERSION_PATCH 0
 
 // Inferring C++ version
 // https://stackoverflow.com/a/61552074
@@ -176,6 +176,40 @@ namespace usearch {
 
 using byte_t = char;
 
+struct checked_size_result_t {
+    std::size_t value;
+    bool overflow;
+    constexpr checked_size_result_t(std::size_t value = 0, bool overflow = false) noexcept
+        : value(value), overflow(overflow) {}
+    constexpr explicit operator bool() const noexcept { return !overflow; }
+};
+
+constexpr checked_size_result_t checked_size_overflow() noexcept { return {0, true}; }
+
+constexpr checked_size_result_t checked_size_from_u64(std::uint64_t value) noexcept {
+    return value > static_cast<std::uint64_t>((std::numeric_limits<std::size_t>::max)())
+               ? checked_size_overflow()
+               : checked_size_result_t{static_cast<std::size_t>(value), false};
+}
+
+constexpr checked_size_result_t checked_add(std::size_t a, std::size_t b) noexcept {
+    return (std::numeric_limits<std::size_t>::max)() - a < b ? checked_size_overflow()
+                                                             : checked_size_result_t{a + b, false};
+}
+
+constexpr checked_size_result_t checked_mul(std::size_t a, std::size_t b) noexcept {
+    return a && b > (std::numeric_limits<std::size_t>::max)() / a ? checked_size_overflow()
+                                                                  : checked_size_result_t{a * b, false};
+}
+
+constexpr checked_size_result_t checked_mul_add_(checked_size_result_t product, std::size_t c) noexcept {
+    return product ? checked_add(product.value, c) : product;
+}
+
+constexpr checked_size_result_t checked_mul_add(std::size_t a, std::size_t b, std::size_t c) noexcept {
+    return checked_mul_add_(checked_mul(a, b), c);
+}
+
 template <std::size_t multiple_ak> std::size_t divide_round_up(std::size_t num) noexcept {
     return (num + multiple_ak - 1) / multiple_ak;
 }
@@ -184,6 +218,21 @@ inline std::size_t divide_round_up(std::size_t num, std::size_t denominator) noe
     return (num + denominator - 1) / denominator;
 }
 
+constexpr checked_size_result_t checked_divide_round_up(std::size_t num, std::size_t denominator) noexcept {
+    return !denominator ? checked_size_overflow()
+           : (std::numeric_limits<std::size_t>::max)() - num < denominator - 1
+               ? checked_size_overflow()
+               : checked_size_result_t{(num + denominator - 1) / denominator, false};
+}
+
+constexpr checked_size_result_t checked_round_up_(checked_size_result_t quotient, std::size_t multiple) noexcept {
+    return quotient ? checked_mul(quotient.value, multiple) : quotient;
+}
+
+constexpr checked_size_result_t checked_round_up(std::size_t num, std::size_t multiple) noexcept {
+    return checked_round_up_(checked_divide_round_up(num, multiple), multiple);
+}
+
 inline std::size_t ceil2(std::size_t v) noexcept {
     v--;
     v |= v >> 1;
@@ -198,6 +247,14 @@ inline std::size_t ceil2(std::size_t v) noexcept {
     return v;
 }
 
+inline checked_size_result_t checked_ceil2(std::size_t v) noexcept {
+    if (!v)
+        return checked_size_result_t{0, false};
+    if (v > (std::size_t{1} << ((sizeof(std::size_t) * CHAR_BIT) - 1)))
+        return checked_size_overflow();
+    return checked_size_result_t{ceil2(v), false};
+}
+
 /// @brief  Simply dereferencing misaligned pointers can be dangerous.
 template <typename at> void misaligned_store(void* ptr, at v) noexcept {
     static_assert(!std::is_reference<at>::value, "Can't store a reference");
@@ -525,9 +582,12 @@ template <typename allocator_at = std::allocator<byte_t>> class bitset_gt {
         count_ = 0;
     }
 
-    bitset_gt(std::size_t capacity) noexcept
-        : slots_((compressed_slot_t*)allocator_t{}.allocate(bits_slots(capacity) * sizeof(compressed_slot_t))),
-          count_(slots_ ? bits_slots(capacity) : 0u) {
+    bitset_gt(std::size_t capacity) noexcept {
+        checked_size_result_t slots_count = checked_divide_round_up(capacity, bits_per_slot());
+        checked_size_result_t bytes =
+            slots_count ? checked_mul(slots_count.value, sizeof(compressed_slot_t)) : slots_count;
+        slots_ = bytes ? (compressed_slot_t*)allocator_t{}.allocate(bytes.value) : nullptr;
+        count_ = slots_ ? slots_count.value : 0u;
         clear();
     }
 
@@ -654,10 +714,19 @@ class striped_locks_gt {
     }
 
     striped_locks_gt(std::size_t threads, std::size_t connectivity) noexcept {
-        std::size_t desired = threads * connectivity * 4;
-        if (desired < 256)
-            desired = 256;
-        count_ = ceil2(desired);
+        checked_size_result_t desired = checked_mul(threads, connectivity);
+        desired = desired ? checked_mul(desired.value, std::size_t{4}) : desired;
+        if (!desired) {
+            shift_ = 64;
+            return;
+        }
+
+        checked_size_result_t count = checked_ceil2((std::max<std::size_t>)(desired.value, 256));
+        if (!count) {
+            shift_ = 64;
+            return;
+        }
+        count_ = count.value;
         shift_ = 64;
         for (std::size_t n = count_; n > 1; n >>= 1)
             shift_--;
@@ -665,7 +734,13 @@ class striped_locks_gt {
         // `cache_line_ak`-aligned address inside the allocation, regardless of
         // what the underlying allocator returns.
         constexpr std::size_t alignment_k = alignof(padded_lock_t);
-        raw_bytes_ = count_ * sizeof(padded_lock_t) + alignment_k;
+        checked_size_result_t raw_bytes = checked_mul_add(count_, sizeof(padded_lock_t), alignment_k);
+        if (!raw_bytes) {
+            count_ = 0;
+            shift_ = 64;
+            return;
+        }
+        raw_bytes_ = raw_bytes.value;
         raw_ = allocator_t{}.allocate(raw_bytes_);
         if (!raw_) {
             raw_bytes_ = 0;
@@ -850,10 +925,14 @@ class max_heap_gt {
         if (new_capacity <= capacity_)
             return true;
 
-        new_capacity = ceil2(new_capacity);
-        if (new_capacity == 0)
+        checked_size_result_t rounded_capacity = checked_ceil2(new_capacity);
+        if (!rounded_capacity)
+            return false;
+        checked_size_result_t doubled_capacity = checked_mul(capacity_, std::size_t{2});
+        if (!doubled_capacity)
             return false;
-        new_capacity = (std::max<std::size_t>)(new_capacity, (std::max<std::size_t>)(capacity_ * 2u, 16u));
+        new_capacity =
+            (std::max<std::size_t>)(rounded_capacity.value, (std::max<std::size_t>)(doubled_capacity.value, 16u));
         auto allocator = allocator_t{};
         auto new_elements = allocator.allocate(new_capacity);
         if (!new_elements)
@@ -1018,10 +1097,14 @@ class sorted_buffer_gt {
         if (new_capacity <= capacity_)
             return true;
 
-        new_capacity = ceil2(new_capacity);
-        if (new_capacity == 0)
+        checked_size_result_t rounded_capacity = checked_ceil2(new_capacity);
+        if (!rounded_capacity)
             return false;
-        new_capacity = (std::max<std::size_t>)(new_capacity, (std::max<std::size_t>)(capacity_ * 2u, 16u));
+        checked_size_result_t doubled_capacity = checked_mul(capacity_, std::size_t{2});
+        if (!doubled_capacity)
+            return false;
+        new_capacity =
+            (std::max<std::size_t>)(rounded_capacity.value, (std::max<std::size_t>)(doubled_capacity.value, 16u));
         auto allocator = allocator_t{};
         auto new_elements = allocator.allocate(new_capacity);
         if (!new_elements)
@@ -1194,6 +1277,31 @@ template <typename element_at> struct hash_gt {
     std::size_t operator()(element_at const& element) const noexcept { return std::hash<element_at>{}(element); }
 };
 
+/**
+ *  @brief  SplitMix64 finalizer, used to scatter integer keys before masking.
+ *
+ *  On libstdc++ and libc++ `std::hash` is the identity for integers. Our open-addressing
+ *  tables mask that hash into a power-of-2 slot count and probe linearly until an @b empty
+ *  slot, so consecutive keys land in adjacent slots and merge into one contiguous run.
+ *  Both insertions and lookups then scan that run end-to-end, which is quadratic overall:
+ *  a dense ascending key range collapses insertion throughput by three orders of magnitude.
+ *  Mixing costs ~20ns per key and is dwarfed by the graph traversal in `add`.
+ */
+template <> struct hash_gt<std::uint64_t> {
+    std::size_t operator()(std::uint64_t const& element) const noexcept {
+        std::uint64_t x = element;
+        x = (x ^ (x >> 30u)) * 0xBF58476D1CE4E5B9ULL;
+        x = (x ^ (x >> 27u)) * 0x94D049BB133111EBULL;
+        return static_cast<std::size_t>(x ^ (x >> 31u));
+    }
+};
+
+template <> struct hash_gt<std::int64_t> {
+    std::size_t operator()(std::int64_t const& element) const noexcept {
+        return hash_gt<std::uint64_t>{}(static_cast<std::uint64_t>(element));
+    }
+};
+
 template <> struct hash_gt<uint40_t> {
     std::size_t operator()(uint40_t const& element) const noexcept { return std::hash<std::size_t>{}(element); }
 };
@@ -1246,9 +1354,11 @@ class growing_hash_set_gt {
         count_ = 0;
     }
 
-    growing_hash_set_gt(std::size_t capacity) noexcept
-        : slots_((element_t*)allocator_t{}.allocate(ceil2(capacity) * sizeof(element_t))),
-          capacity_(slots_ ? ceil2(capacity) : 0u), count_(0u) {
+    growing_hash_set_gt(std::size_t capacity) noexcept : count_(0u) {
+        checked_size_result_t slots_count = checked_ceil2(capacity);
+        checked_size_result_t bytes = slots_count ? checked_mul(slots_count.value, sizeof(element_t)) : slots_count;
+        slots_ = bytes ? (element_t*)allocator_t{}.allocate(bytes.value) : nullptr;
+        capacity_ = slots_ ? slots_count.value : 0u;
         clear();
     }
 
@@ -1306,12 +1416,21 @@ class growing_hash_set_gt {
      *  @return `true` if enough capacity is available, `false` if memory allocation failed.
      */
     bool reserve(std::size_t new_capacity) noexcept {
-        new_capacity = (new_capacity * 5u) / 3u;
+        checked_size_result_t scaled_capacity = checked_mul(new_capacity, std::size_t{5});
+        if (!scaled_capacity)
+            return false;
+        new_capacity = scaled_capacity.value / 3u;
         if (new_capacity <= capacity_)
             return true;
 
-        new_capacity = ceil2(new_capacity);
-        element_t* new_slots = (element_t*)allocator_t{}.allocate(new_capacity * sizeof(element_t));
+        checked_size_result_t rounded_capacity = checked_ceil2(new_capacity);
+        if (!rounded_capacity)
+            return false;
+        new_capacity = rounded_capacity.value;
+        checked_size_result_t new_bytes = checked_mul(new_capacity, sizeof(element_t));
+        if (!new_bytes)
+            return false;
+        element_t* new_slots = (element_t*)allocator_t{}.allocate(new_bytes.value);
         if (!new_slots)
             return false;
 
@@ -1414,7 +1533,10 @@ class ring_gt {
             return false; // prevent data loss
         if (n <= capacity())
             return true;
-        n = (std::max<std::size_t>)(ceil2(n), 64u);
+        checked_size_result_t rounded_capacity = checked_ceil2(n);
+        if (!rounded_capacity)
+            return false;
+        n = (std::max<std::size_t>)(rounded_capacity.value, 64u);
         element_t* elements = allocator_.allocate(n);
         if (!elements)
             return false;
@@ -1443,8 +1565,7 @@ class ring_gt {
     bool try_push(element_t const& value) noexcept {
         if (head_ == tail_ && !empty_)
             return false; // `elements_` is full
-
-        return push(value);
+        push(value);
         return true;
     }
 
@@ -1504,12 +1625,22 @@ struct index_config_t {
     inline error_t validate() noexcept {
         if (connectivity == 0)
             connectivity = default_connectivity();
-        if (connectivity_base == 0)
-            connectivity_base = connectivity * 2;
+        if (connectivity_base == 0) {
+            checked_size_result_t default_base = checked_mul(connectivity, std::size_t{2});
+            if (!default_base)
+                return "Connectivity is too large";
+            connectivity_base = default_base.value;
+        }
         if (connectivity < 2)
             return "Connectivity must be at least 2, otherwise the index degenerates into ropes";
         if (connectivity_base < connectivity)
             return "Base layer should be at least as connected as the rest of the graph";
+        checked_size_result_t neighbors_bytes =
+            checked_mul_add(connectivity, sizeof(std::uint64_t), sizeof(std::uint32_t));
+        checked_size_result_t neighbors_base_bytes =
+            checked_mul_add(connectivity_base, sizeof(std::uint64_t), sizeof(std::uint32_t));
+        if (!neighbors_bytes || !neighbors_base_bytes)
+            return "Connectivity is too large";
         return {};
     }
 
@@ -1520,6 +1651,15 @@ struct index_config_t {
     inline bool is_valid() const noexcept { return connectivity >= 2 && connectivity_base >= connectivity; }
 };
 
+/**
+ *  @brief  Tag type selecting the "no upfront reservation" overload of
+ *          @ref index_limits_t.  Modeled after @c std::defer_lock: the
+ *          resulting limits are all-zero and produce no allocations when
+ *          handed to @ref index_dense_gt::try_reserve.
+ */
+struct unreserved_t {};
+constexpr unreserved_t unreserved{};
+
 /**
  *  @brief  Growth settings for the index container.
  *          Includes the upper bound for `::members` capacity,
@@ -1527,18 +1667,32 @@ struct index_config_t {
  */
 struct index_limits_t {
     /// @brief Maximum number of entries in the index.
-    std::size_t members = 0;
+    std::size_t members;
     /// @brief Max number of threads simultaneously updating entries.
-    std::size_t threads_add = std::thread::hardware_concurrency();
+    std::size_t threads_add;
     /// @brief Max number of threads simultaneously searching entries.
-    std::size_t threads_search = std::thread::hardware_concurrency();
+    std::size_t threads_search;
 
     inline index_limits_t(std::size_t n, std::size_t t) noexcept : members(n), threads_add(t), threads_search(t) {}
-    inline index_limits_t(std::size_t n = 0) noexcept : index_limits_t(n, std::thread::hardware_concurrency()) {}
+    inline index_limits_t(std::size_t n = 0) noexcept
+        : index_limits_t(n, (std::max<std::size_t>)(1, std::thread::hardware_concurrency())) {}
+    inline index_limits_t(unreserved_t) noexcept : members(0), threads_add(0), threads_search(0) {}
     /// @brief Returns the upper limit for the number of threads.
     inline std::size_t threads() const noexcept { return (std::max)(threads_add, threads_search); }
     /// @brief Returns the concurrency-level of the index - the minimum of thread counts.
     inline std::size_t concurrency() const noexcept { return (std::min)(threads_add, threads_search); }
+    /// @brief Returns a copy with zero thread counts replaced by the library default.
+    ///        Use when carrying limits forward across operations that may have left
+    ///        @c threads_add / @c threads_search unset (e.g. @c unreserved construction).
+    inline index_limits_t with_thread_defaults() const noexcept {
+        index_limits_t result = *this;
+        index_limits_t const defaults;
+        if (!result.threads_add)
+            result.threads_add = defaults.threads_add;
+        if (!result.threads_search)
+            result.threads_search = defaults.threads_search;
+        return result;
+    }
 };
 
 struct index_update_config_t {
@@ -2414,6 +2568,14 @@ class index_gt {
     /// @brief  Array of thread-specific buffers for temporary data.
     mutable buffer_gt<context_t, contexts_allocator_t> contexts_{};
 
+    context_t* context_or_null_(std::size_t thread) noexcept {
+        return thread < contexts_.size() ? contexts_.data() + thread : nullptr;
+    }
+
+    context_t const* context_or_null_(std::size_t thread) const noexcept {
+        return thread < contexts_.size() ? contexts_.data() + thread : nullptr;
+    }
+
   public:
     std::size_t connectivity() const noexcept { return config_.connectivity; }
     std::size_t capacity() const noexcept { return nodes_capacity_; }
@@ -2547,6 +2709,114 @@ class index_gt {
     member_iterator_t iterator_at(compressed_slot_t slot) noexcept { return {this, slot}; }
     member_citerator_t citerator_at(compressed_slot_t slot) const noexcept { return {this, slot}; }
 
+    /**
+     *  @brief  A read-only random-access range over the neighbors of a single
+     *          node at a single graph level. Dereferencing yields a `member_cref_t`,
+     *          so callers can chain traversals without touching internal slots.
+     *
+     *  @warning The range aliases the node's adjacency tape. It is only valid
+     *           while the index is not being mutated. Prefer immutable indexes
+     *           (see `is_immutable()`) or guarantee no concurrent `add`/`update`/
+     *           `remove` while the view is alive.
+     */
+    class neighbors_view_t {
+        index_gt const* index_{};
+        neighbors_ref_t neighbors_{nullptr};
+
+      public:
+        class const_iterator {
+            index_gt const* index_{};
+            misaligned_ptr_gt<compressed_slot_t const> position_{nullptr};
+
+          public:
+            using iterator_category = std::random_access_iterator_tag;
+            using value_type = member_cref_t;
+            using difference_type = std::ptrdiff_t;
+            using pointer = void;
+            using reference = member_cref_t;
+
+            const_iterator() noexcept = default;
+            const_iterator(index_gt const* index, misaligned_ptr_gt<compressed_slot_t const> position) noexcept
+                : index_(index), position_(position) {}
+
+            reference operator*() const noexcept {
+                compressed_slot_t slot = static_cast<compressed_slot_t>(*position_);
+                return {index_->node_at_(slot).ckey(), slot};
+            }
+            compressed_slot_t slot() const noexcept { return static_cast<compressed_slot_t>(*position_); }
+
+            // clang-format off
+            const_iterator& operator++() noexcept { ++position_; return *this; }
+            const_iterator operator++(int) noexcept { const_iterator old = *this; ++position_; return old; }
+            const_iterator& operator--() noexcept { --position_; return *this; }
+            const_iterator operator--(int) noexcept { const_iterator old = *this; --position_; return old; }
+            const_iterator& operator+=(difference_type d) noexcept { position_ = position_ + d; return *this; }
+            const_iterator& operator-=(difference_type d) noexcept { position_ = position_ - d; return *this; }
+            const_iterator operator+(difference_type d) const noexcept { return {index_, position_ + d}; }
+            const_iterator operator-(difference_type d) const noexcept { return {index_, position_ - d}; }
+            difference_type operator-(const_iterator const& other) const noexcept { return position_ - other.position_; }
+            bool operator==(const_iterator const& other) const noexcept { return position_ == other.position_; }
+            bool operator!=(const_iterator const& other) const noexcept { return position_ != other.position_; }
+            // clang-format on
+        };
+
+        using iterator = const_iterator;
+        using value_type = member_cref_t;
+        using size_type = std::size_t;
+
+        neighbors_view_t() noexcept = default;
+        neighbors_view_t(index_gt const* index, neighbors_ref_t neighbors) noexcept
+            : index_(index), neighbors_(neighbors) {}
+
+        std::size_t size() const noexcept { return index_ ? neighbors_.size() : 0; }
+        bool empty() const noexcept { return size() == 0; }
+        member_cref_t operator[](std::size_t offset) const noexcept {
+            compressed_slot_t slot = neighbors_[offset];
+            return {index_->node_at_(slot).ckey(), slot};
+        }
+        const_iterator begin() const noexcept {
+            return index_ ? const_iterator{index_, neighbors_.begin()} : const_iterator{};
+        }
+        const_iterator end() const noexcept {
+            return index_ ? const_iterator{index_, neighbors_.end()} : const_iterator{};
+        }
+        const_iterator cbegin() const noexcept { return begin(); }
+        const_iterator cend() const noexcept { return end(); }
+    };
+
+    /**
+     *  @brief  Returns a read-only range over the neighbors of the node at @p slot
+     *          in the graph @p level. Returned view is empty when @p level exceeds
+     *          the node's level.
+     */
+    neighbors_view_t neighbors(compressed_slot_t slot, std::size_t level) const noexcept {
+        node_t node = node_at_(slot);
+        if (static_cast<level_t>(level) > node.level())
+            return {};
+        return {this, neighbors_(node, static_cast<level_t>(level))};
+    }
+
+    /**
+     *  @brief  Returns a read-only range over the neighbors of the node referenced
+     *          by @p member at the graph @p level.
+     */
+    neighbors_view_t neighbors(member_citerator_t member, std::size_t level) const noexcept {
+        return neighbors(get_slot(member), level);
+    }
+
+    /**
+     *  @brief  Returns the top graph level at which the node at @p slot is present.
+     */
+    std::size_t level_of(compressed_slot_t slot) const noexcept {
+        return static_cast<std::size_t>(static_cast<level_t>(node_at_(slot).level()));
+    }
+
+    /**
+     *  @brief  Returns the top graph level at which the node referenced by @p member
+     *          is present.
+     */
+    std::size_t level_of(member_citerator_t member) const noexcept { return level_of(get_slot(member)); }
+
     dynamic_allocator_t const& dynamic_allocator() const noexcept { return dynamic_allocator_; }
     tape_allocator_t const& tape_allocator() const noexcept { return tape_allocator_; }
 
@@ -2919,7 +3189,10 @@ class index_gt {
             return result.failed("Can't add to an immutable index");
 
         // Make sure we have enough local memory to perform this request
-        context_t& context = contexts_[config.thread];
+        context_t* context_ptr = context_or_null_(config.thread);
+        if (!context_ptr)
+            return result.failed("Reserve capacity ahead of insertions!");
+        context_t& context = *context_ptr;
         top_candidates_t& top = context.top_candidates;
         next_candidates_t& next = context.next_candidates;
         top.clear();
@@ -3057,7 +3330,10 @@ class index_gt {
         compressed_slot_t updated_slot = iterator.slot_;
 
         // Make sure we have enough local memory to perform this request
-        context_t& context = contexts_[config.thread];
+        context_t* context_ptr = context_or_null_(config.thread);
+        if (!context_ptr)
+            return result.failed("Reserve capacity ahead of updates!");
+        context_t& context = *context_ptr;
         top_candidates_t& top = context.top_candidates;
         next_candidates_t& next = context.next_candidates;
         top.clear();
@@ -3425,26 +3701,31 @@ class index_gt {
 
         // Progress status
         std::size_t processed = 0;
-        std::size_t const total = 2 * header.size;
+        checked_size_result_t header_size = checked_size_from_u64(header.size);
+        if (!header_size)
+            return result.failed("Index is too large to serialize");
+        checked_size_result_t total = checked_mul(std::size_t{2}, header_size.value);
+        if (!total)
+            return result.failed("Index is too large to serialize");
 
         // Export the number of levels per node
         // That is both enough to estimate the overall memory consumption,
         // and to be able to estimate the offsets of every entry in the file.
-        for (std::size_t i = 0; i != header.size; ++i) {
+        for (std::size_t i = 0; i != header_size.value; ++i) {
             node_t node = node_at_(i);
             level_t level = node.level();
             if (!output(&level, sizeof(level)))
                 return result.failed("Failed to serialize into stream");
-            if (!progress(++processed, total))
+            if (!progress(++processed, total.value))
                 return result.failed("Terminated by user");
         }
 
         // After that dump the nodes themselves
-        for (std::size_t i = 0; i != header.size; ++i) {
+        for (std::size_t i = 0; i != header_size.value; ++i) {
             span_bytes_t node_bytes = node_bytes_(node_at_(i));
             if (!output(node_bytes.data(), node_bytes.size()))
                 return result.failed("Failed to serialize into stream");
-            if (!progress(++processed, total))
+            if (!progress(++processed, total.value))
                 return result.failed("Terminated by user");
         }
 
@@ -3476,10 +3757,16 @@ class index_gt {
 
         // Allocate some dynamic memory to read all the levels
         using levels_allocator_t = typename dynamic_allocator_traits_t::template rebind_alloc<level_t>;
-        buffer_gt<level_t, levels_allocator_t> levels(header.size);
+        checked_size_result_t header_size = checked_size_from_u64(header.size);
+        if (!header_size)
+            return result.failed("Index is too large");
+        buffer_gt<level_t, levels_allocator_t> levels(header_size.value);
         if (!levels)
             return result.failed("Out of memory");
-        if (!input(levels, header.size * sizeof(level_t)))
+        checked_size_result_t levels_bytes = checked_mul(header_size.value, sizeof(level_t));
+        if (!levels_bytes)
+            return result.failed("Index is too large");
+        if (!input(levels, levels_bytes.value))
             return result.failed("Failed to pull nodes levels from the stream");
 
         // Submit metadata
@@ -3491,26 +3778,26 @@ class index_gt {
 
         pre_ = precompute_(config_);
         index_limits_t limits;
-        limits.members = header.size;
+        limits.members = header_size.value;
         limits.threads_add = (std::max<std::size_t>)(1, old_limits.threads_add);
         limits.threads_search = (std::max<std::size_t>)(1, old_limits.threads_search);
         if (!reserve(limits)) {
             reset();
             return result.failed("Out of memory");
         }
-        nodes_count_ = header.size;
+        nodes_count_ = header_size.value;
         max_level_ = static_cast<level_t>(header.max_level);
         entry_slot_ = static_cast<compressed_slot_t>(header.entry_slot);
 
         // Load the nodes
-        for (std::size_t i = 0; i != header.size; ++i) {
+        for (std::size_t i = 0; i != header_size.value; ++i) {
             span_bytes_t node_bytes = node_malloc_(levels[i]);
             if (!input(node_bytes.data(), node_bytes.size())) {
                 reset();
                 return result.failed("Failed to pull nodes from the stream");
             }
             nodes_[i] = node_t{node_bytes.data()};
-            if (!progress(i + 1, header.size))
+            if (!progress(i + 1, header_size.value))
                 return result.failed("Terminated by user");
         }
         return {};
@@ -3657,11 +3944,14 @@ class index_gt {
             reset();
             return result;
         }
+        checked_size_result_t header_size = checked_size_from_u64(header.size);
+        if (!header_size)
+            return result.failed("Index is too large");
 
         // Precompute offsets of every node, but before that we need to update the configs
         // This could have been done with `std::exclusive_scan`, but it's only available from C++17.
         using offsets_allocator_t = typename dynamic_allocator_traits_t::template rebind_alloc<std::size_t>;
-        buffer_gt<std::size_t, offsets_allocator_t> offsets(header.size);
+        buffer_gt<std::size_t, offsets_allocator_t> offsets(header_size.value);
         if (!offsets)
             return result.failed("Out of memory");
 
@@ -3673,33 +3963,47 @@ class index_gt {
 
         pre_ = precompute_(config_);
         misaligned_ptr_gt<level_t> levels{(byte_t*)file.data() + offset + sizeof(header)};
-        offsets[0u] = offset + sizeof(header) + sizeof(level_t) * header.size;
-        for (std::size_t i = 1; i < header.size; ++i)
-            offsets[i] = offsets[i - 1] + node_bytes_(levels[i - 1]);
+        checked_size_result_t levels_bytes = checked_mul(sizeof(level_t), header_size.value);
+        checked_size_result_t offset_after_header = checked_add(offset, sizeof(header));
+        checked_size_result_t first_offset = levels_bytes && offset_after_header
+                                                 ? checked_add(offset_after_header.value, levels_bytes.value)
+                                                 : checked_size_overflow();
+        if (!first_offset)
+            return result.failed("Index is too large");
+        offsets[0u] = first_offset.value;
+        for (std::size_t i = 1; i < header_size.value; ++i) {
+            checked_size_result_t next_offset = checked_add(offsets[i - 1], node_bytes_(levels[i - 1]));
+            if (!next_offset)
+                return result.failed("Index is too large");
+            offsets[i] = next_offset.value;
+        }
 
-        std::size_t total_bytes = offsets[header.size - 1] + node_bytes_(levels[header.size - 1]);
-        if (file.size() < total_bytes) {
+        checked_size_result_t total_bytes =
+            checked_add(offsets[header_size.value - 1], node_bytes_(levels[header_size.value - 1]));
+        if (!total_bytes)
+            return result.failed("Index is too large");
+        if (file.size() < total_bytes.value) {
             reset();
             return result.failed("File is corrupted and can't fit all the nodes");
         }
 
         // Submit metadata and reserve memory
         index_limits_t limits;
-        limits.members = header.size;
+        limits.members = header_size.value;
         limits.threads_add = (std::max<std::size_t>)(1, old_limits.threads_add);
         limits.threads_search = (std::max<std::size_t>)(1, old_limits.threads_search);
         if (!reserve(limits)) {
             reset();
             return result.failed("Out of memory");
         }
-        nodes_count_ = header.size;
+        nodes_count_ = header_size.value;
         max_level_ = static_cast<level_t>(header.max_level);
         entry_slot_ = static_cast<compressed_slot_t>(header.entry_slot);
 
         // Rapidly address all the nodes
-        for (std::size_t i = 0; i != header.size; ++i) {
+        for (std::size_t i = 0; i != header_size.value; ++i) {
             nodes_[i] = node_t{(byte_t*)file.data() + offsets[i]};
-            if (!progress(i + 1, header.size))
+            if (!progress(i + 1, header_size.value))
                 return result.failed("Terminated by user");
         }
         viewed_file_ = std::move(file);
@@ -3751,7 +4055,9 @@ class index_gt {
         // Progress status
         std::atomic<bool> do_tasks{true};
         std::atomic<std::size_t> processed{0};
-        std::size_t const total = 3 * slots_and_levels.size();
+        checked_size_result_t total = checked_mul(std::size_t{3}, slots_and_levels.size());
+        if (!total)
+            return;
 
         // For every bottom level node, determine its parent cluster
         executor.dynamic(slots_and_levels.size(), [&](std::size_t thread_idx, std::size_t old_slot_as_uint) {
@@ -3764,7 +4070,7 @@ class index_gt {
             slots_and_levels[old_slot] = {old_slot, cluster, node_at_(old_slot).level()};
             ++processed;
             if (thread_idx == 0)
-                do_tasks = progress(processed.load(), total);
+                do_tasks = progress(processed.load(), total.value);
             return do_tasks.load();
         });
         if (!do_tasks.load())
@@ -3798,7 +4104,7 @@ class index_gt {
                     neighbor = static_cast<compressed_slot_t>(old_slot_to_new[compressed_slot_t(neighbor)]);
 
             reordered_nodes[new_slot] = new_node;
-            if (!progress(++processed, total))
+            if (!progress(++processed, total.value))
                 return;
         }
 
@@ -3807,7 +4113,7 @@ class index_gt {
             slot_transition(node_at_(old_slot).ckey(),                //
                             static_cast<compressed_slot_t>(old_slot), //
                             static_cast<compressed_slot_t>(new_slot));
-            if (!progress(++processed, total))
+            if (!progress(++processed, total.value))
                 return;
         }