Skip to content

Fix integer overflow in ReadFile buffer pre-allocation - #29207

Closed
robobun wants to merge 2 commits into
mainfrom
farm/8fde255c/fix-readfile-size-overflow
Closed

Fix integer overflow in ReadFile buffer pre-allocation#29207
robobun wants to merge 2 commits into
mainfrom
farm/8fde255c/fix-readfile-size-overflow

Fix integer overflow in ReadFile buffer pre-allocation

5bd3812
Select commit
Loading
Failed to load commit list.
Claude / Claude Code Review completed Apr 12, 2026 in 10m 33s

Code review found 1 important issue

Found 5 candidates, confirmed 1. See review comments for details.

Details

Severity Count
🔴 Important 1
🟡 Nit 0
🟣 Pre-existing 0
Severity File:Line Issue
🔴 Important src/bun.js/webcore/blob/read_file.zig:384-390 OOM not propagated as JS error in ReadFile POSIX path

Annotations

Check failure on line 390 in src/bun.js/webcore/blob/read_file.zig

See this annotation in the file changed.

@claude claude / Claude Code Review

OOM not propagated as JS error in ReadFile POSIX path

In `ReadFile.runAsyncWithFD`, the OOM catch block sets only `this.errno` but leaves `this.system_error` null; since `then()` dispatches errors solely via `system_error`, an OOM during buffer pre-allocation silently resolves the JS promise with an empty string instead of rejecting. Add `this.system_error = bun.sys.Error.fromCode(bun.sys.E.NOMEM, .read).toSystemError();` alongside the existing `this.errno = err;` at line 388.