zlib: safe FFI bindings via z_stream type invariants

src/crash_handler/lib.rs

@@ -2743,35 +2743,19 @@ mod draft {
                 writer.write_byte(b'0')?;
 
                 let mut compressed_bytes: [u8; 2048] = [0; 2048];
-                let mut len: bun_zlib::uLong = compressed_bytes.len() as bun_zlib::uLong;
-                // SAFETY: buffers and lengths are valid
-                let ret = unsafe {
-                    bun_zlib::compress2(
-                        compressed_bytes.as_mut_ptr(),
-                        &raw mut len,
-                        message.as_ptr(),
-                        u32::try_from(message.len()).expect("int cast") as bun_zlib::uLong,
-                        9,
-                    )
-                };
-                // Match on the raw zlib return code so this stays ABI-correct
-                // regardless of whether the platform `compress2` binding returns
-                // `c_int` (posix) or the `ReturnCode` enum (win32).
-                let compressed = match ret as i32 {
-                    r if r == bun_zlib::ReturnCode::Ok as i32 => {
-                        &compressed_bytes[0..usize::try_from(len).expect("int cast")]
-                    }
+                let compressed = match bun_zlib::compress2_into(&mut compressed_bytes, message, 9) {
+                    Ok(len) => &compressed_bytes[0..len],
                     // Insufficient memory.
-                    r if r == bun_zlib::ReturnCode::MemError as i32 => {
+                    Err(bun_zlib::ReturnCode::MemError) => {
                         return Err(crate::Error::Alloc(bun_alloc::AllocError));
                     }
                     // The buffer dest was not large enough to hold the compressed data.
-                    r if r == bun_zlib::ReturnCode::BufError as i32 => {
+                    Err(bun_zlib::ReturnCode::BufError) => {
                         return Err(crate::Error::Sys(bun_errno::SystemErrno::ENOSPC));
                     }
                     // The level was not Z_DEFAULT_LEVEL, or was not between 0 and 9.
                     // This is technically possible but impossible because we pass 9.
-                    _ => return Err(crate::Error::Unexpected),
+                    Err(_) => return Err(crate::Error::Unexpected),
                 };
 
                 let mut b64_bytes: [u8; 2048] = [0; 2048];

src/runtime/node/node_zlib_binding.rs

@@ -190,7 +190,14 @@ pub(crate) fn crc32(global_this: &JSGlobalObject, callframe: &CallFrame) -> JsRe
 /// Backing-stream surface used by [`CompressionStream`] (zlib / brotli / zstd
 /// `Context` types).
 pub(crate) trait CompressionContext {
-    fn set_buffers(&mut self, in_: Option<&[u8]>, out: Option<&mut [u8]>);
+    /// # Safety
+    /// The stored raw pointers persist past the slice borrows. Callers must
+    /// guarantee the backing memory of `in_`/`out` remains valid and
+    /// unmoved until the next `do_work()` completes. The
+    /// `CompressionStream::write[_sync]` call sites below discharge this via
+    /// pinning (async path) or call-frame rooting + synchronous `do_work`
+    /// (sync path).
+    unsafe fn set_buffers(&mut self, in_: Option<&[u8]>, out: Option<&mut [u8]>);
     fn set_flush(&mut self, flush: i32);
     fn do_work(&mut self);
     fn reset(&mut self) -> Error;
@@ -433,7 +440,10 @@ impl<T: CompressionStreamImpl> CompressionStream<T> {
         T::pending_output_set_cached(this_value, global_this, arguments[4]);
 
         this.stream().with_mut(|s| {
-            s.set_buffers(in_, out);
+            // SAFETY: `in_`/`out` are slices into pinned JS `ArrayBuffer`s,
+            // rooted by `pending_input`/`pending_output` above until
+            // `run_from_js_thread` unpins them after `do_work` completes.
+            unsafe { s.set_buffers(in_, out) };
             s.set_flush(i32::try_from(flush).expect("int cast"));
         });
 
@@ -683,7 +693,11 @@ impl<T: CompressionStreamImpl> CompressionStream<T> {
         this.ref_();
 
         this.stream().with_mut(|s| {
-            s.set_buffers(in_, out);
+            // SAFETY: `in_`/`out` are slices into JS `ArrayBuffer`s rooted by
+            // the call frame (`arguments[1]`/`[4]`); `do_work` runs
+            // synchronously below without entering JS, so neither backing
+            // store can move or detach.
+            unsafe { s.set_buffers(in_, out) };
             s.set_flush(i32::try_from(flush).expect("int cast"));
         });
         let this_value = callframe.this();
@@ -985,7 +999,8 @@ macro_rules! __impl_compression_stream {
         }
 
         impl $crate::node::node_zlib_binding::CompressionContext for $ctx {
-            #[inline] fn set_buffers(&mut self, in_: Option<&[u8]>, out: Option<&mut [u8]>) { Self::set_buffers(self, in_, out) }
+            // SAFETY: forwarded to the inherent `unsafe fn` with the same contract.
+            #[inline] unsafe fn set_buffers(&mut self, in_: Option<&[u8]>, out: Option<&mut [u8]>) { unsafe { Self::set_buffers(self, in_, out) } }
             #[inline] fn set_flush(&mut self, flush: i32) { Self::set_flush(self, flush) }
             #[inline] fn do_work(&mut self) { Self::do_work(self) }
             #[inline] fn reset(&mut self) -> $crate::node::node_zlib_binding::Error { Self::reset(self) }

src/runtime/node/zlib/NativeBrotli.rs

@@ -523,7 +523,9 @@ mod _impl {
             self.state = None;
         }
 
-        pub fn set_buffers(&mut self, in_: Option<&[u8]>, out: Option<&mut [u8]>) {
+        /// # Safety
+        /// See [`CompressionContext::set_buffers`](crate::node::node_zlib_binding::CompressionContext::set_buffers).
+        pub unsafe fn set_buffers(&mut self, in_: Option<&[u8]>, out: Option<&mut [u8]>) {
             self.next_in = in_.map_or(ptr::null(), |p| p.as_ptr());
             self.avail_in = in_.map_or(0, |p| p.len());
             // Reshaped for borrowck — compute ptr/len before consuming `out`.