Skip to content

Enforce maxBuffer and validate timeout in child_process - #1379

Closed
ctate wants to merge 8 commits into
mainfrom
ctate/enforce-maxbuffer-validate-d4fd3c
Closed

ctate wants to merge 8 commits into
mainfrom
ctate/enforce-maxbuffer-validate-d4fd3c

Conversation

@ctate

@ctate ctate commented Oct 19, 2026

Copy link
Copy Markdown
Collaborator
  • execSync, execFileSync and spawnSync throw Node's ENOBUFS past maxBuffer (1 MiB by default), and exec/execFile cut the stream and fail with ERR_CHILD_PROCESS_STDIO_MAXBUFFER.
  • An invalid timeout or maxBuffer throws ERR_OUT_OF_RANGE before spawning, synchronously for the promisified forms too.
  • Runtime benchmark geomean unchanged (geomean −0.7%; programs without the exec callback forms within 352 B of text).

The sync forms (execSync, execFileSync) and spawnSync apply maxBuffer to
both outputs together, with Node's 1 MiB default and 0 meaning no limit.
Past it the child gets the kill signal, every stdio pipe is closed so a
grandchild holding one cannot keep the call waiting, and the call throws
Node's ENOBUFS spawnSync error (spawnSync reports it on result.error).
Pipes are also closed on a timeout kill.

exec and execFile, in the callback and promisified forms, apply it per
stream as lib/child_process.js does: the chunk that passes the limit is
cut to the remaining UTF-16 length, both streams are destroyed and the
child is killed, and the error is
a RangeError with code ERR_CHILD_PROCESS_STDIO_MAXBUFFER and cmd (plus
stdout and stderr when promisified).

A negative or NaN maxBuffer, or a timeout that is not a non-negative
integer, throws ERR_OUT_OF_RANGE before anything spawns. The promisified
forms throw it synchronously, as Node's custom promisify calls execFile
directly.
@vercel

vercel Bot commented Oct 19, 2026 •

Copy link
Copy Markdown
Contributor

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
scriptc Ready Ready Preview, v0 Oct 20, 2026 6:27pm UTC

@vercel-security-reviewer

Copy link
Copy Markdown

Security review details

Comment thread packages/runtime/src/scr_child.c Outdated
exec compares its output's length with maxBuffer as a number and keeps
`maxBuffer - previous total` UTF-16 code units of the chunk that passed it,
as Node does. With a fractional limit, that allowance had a fraction left:
an ASCII character with less than one unit left took the branch that keeps
the high surrogate of an astral character, which decoded and rewrote four
bytes from that position, past the end of the capture buffer when the cut
fell at its end.

The allowance is now truncated to whole units, as Node's slice truncates
its end, and the high surrogate is kept only for a complete four-byte
character with exactly one unit left. Keeping it now records that a lone
surrogate exists, so JSON.stringify and other string operations escape it
as Node does.
…bers

The merge combined this PR's two-line removal in tests/diagnostics/child-process.ts with main's new piped-stream section, whose snapshot lines kept main's numbering.

This branch was successfully deployed

1 active deployment
Preview — 4e6ca2ec Deployed Oct 20, 2026 by vercel[bot]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant