Fix Bun.pathToFileURL crash with relative paths longer than PATH_MAX

src/resolver/resolve_path.zig

@@ -2048,9 +2048,19 @@ export fn ResolvePath__joinAbsStringBufCurrentPlatformBunString(
     const str = in.toUTF8WithoutRef(bun.default_allocator);
     defer str.deinit();
 
+    const cwd = globalObject.bunVM().transpiler.fs.top_level_dir;
+
+    // The input is user-controlled and may be arbitrarily long. The
+    // threadlocal `join_buf` is only 4096 bytes, so use a stack-fallback
+    // allocator that heap-allocates for oversized inputs.
+    var sfa = std.heap.stackFallback(4096, bun.default_allocator);
+    const alloc = sfa.get();
+    const buf = bun.handleOom(alloc.alloc(u8, cwd.len + str.slice().len + 2));
+    defer alloc.free(buf);
+
     const out_slice = joinAbsStringBuf(
-        globalObject.bunVM().transpiler.fs.top_level_dir,
-        &join_buf,
+        cwd,
+        buf,
         &.{str.slice()},
         .auto,
     );

test/js/bun/util/fileUrl.test.js

@@ -6,6 +6,18 @@ describe("pathToFileURL", () => {
   it("should convert a path to a file url", () => {
     expect(pathToFileURL("/path/to/file.js").href).toBe("file:///path/to/file.js");
   });
+
+  it("should handle relative paths longer than PATH_MAX", () => {
+    const long = Buffer.alloc(6000, "a").toString();
+    const url = pathToFileURL(long);
+    expect(url.href.endsWith("/" + long)).toBe(true);
+  });
+
+  it("should normalize long relative paths with .. segments", () => {
+    const input = Buffer.alloc(14000, "abcdef/").toString() + Buffer.alloc(6000, "../").toString() + "final";
+    const url = pathToFileURL(input);
+    expect(url.href).toBe(`${pathToFileURL(process.cwd())}/final`);
+  });
 });
 
 describe("fileURLToPath", () => {