Skip to content

Fix use-after-free in Bun.Transpiler async transform() parse errors - #30020

Closed
robobun wants to merge 2 commits into
mainfrom
farm/d517fa80/transpiler-transform-error-uaf
Closed

Fix use-after-free in Bun.Transpiler async transform() parse errors#30020
robobun wants to merge 2 commits into
mainfrom
farm/d517fa80/transpiler-transform-error-uaf

Fix use-after-free in Bun.Transpiler async transform() parse errors

efe71ac
Select commit
Loading
Failed to load commit list.
Claude / Claude Code Review completed May 1, 2026 in 17m 22s

Code review found 1 potential issue

Found 1 candidates, confirmed 1. See review comments for details.

Details

Severity Count
🔴 Important 0
🟡 Nit 1
🟣 Pre-existing 0
Severity File:Line Issue
🟡 Nit src/bun.js/api/JSTranspiler.zig:494-502 Memory leak: cloned log message buffers never freed

Annotations

Check warning on line 502 in src/bun.js/api/JSTranspiler.zig

See this annotation in the file changed.

@claude claude / Claude Code Review

Memory leak: cloned log message buffers never freed

Minor: `appendToWithRecycled` allocates a `StringBuilder` buffer and a `notes_buf` in `bun.default_allocator` to hold the cloned message text, but `Log.deinit()` only does `msgs.clearAndFree()` and never frees those buffers — so each async `transform()` parse error leaks the cloned error text. This is the same pre-existing pattern as every other `appendToWithRecycled` caller and trading a UAF for a small error-path leak is clearly the right call here; just flagging it as a candidate for a follow