blob: clamp stat.size to max_size to avoid @intCast panic in ReadFile

src/bun.js/webcore/blob/read_file.zig

@@ -340,7 +340,7 @@ pub const ReadFile = struct {
         }
 
         this.could_block = !bun.isRegularFile(stat.mode);
-        this.total_size = @truncate(@as(SizeType, @intCast(@max(@as(i64, @intCast(stat.size)), 0))));
+        this.total_size = @intCast(@min(@max(stat.size, 0), Blob.max_size));
 
         if (stat.size > 0 and !this.could_block) {
             this.size = @min(this.total_size, this.max_length);
@@ -383,6 +383,7 @@ pub const ReadFile = struct {
         if (!this.could_block or (this.size > 0 and this.size != Blob.max_size))
             this.buffer = std.ArrayListUnmanaged(u8).initCapacity(bun.default_allocator, this.size +| 16) catch |err| {
                 this.errno = err;
+                this.system_error = bun.sys.Error.fromCode(bun.sys.E.NOMEM, .read).toSystemError();
                 this.onFinish();
                 return;
             };
@@ -656,7 +657,7 @@ pub const ReadFileUV = struct {
             this.onFinish();
             return;
         }
-        this.total_size = @truncate(@as(SizeType, @intCast(@max(@as(i64, @intCast(stat.size)), 0))));
+        this.total_size = @intCast(@min(@max(stat.size, 0), Blob.max_size));
         this.is_regular_file = bun.isRegularFile(stat.mode);
 
         log("is_regular_file: {}", .{this.is_regular_file});

test/js/bun/util/bun-file-fd-read.test.ts

@@ -0,0 +1,52 @@
+import { describe, expect, test } from "bun:test";
+import { closeSync, openSync } from "fs";
+import { isWindows, tempDir } from "harness";
+import { join } from "path";
+
+// Reading a Bun.file() backed by a file descriptor goes through
+// ReadFile.runAsync -> getFd (opened_fd already set) -> runAsyncWithFD ->
+// resolveSizeAndLastModified, which derives total_size from fstat. That
+// computation previously used @intCast to u52 guarded by a dead @truncate,
+// so an abnormal fstat size could trip integerOutOfBounds. Triggering that
+// directly requires fstat to report > 4.5 PB which is not achievable here,
+// but these tests lock in the fd-backed ReadFile path that the fuzzer hit.
+describe.skipIf(isWindows)("Bun.file(fd) read", () => {
+  async function withFd<T>(path: string, fn: (fd: number) => Promise<T>): Promise<T> {
+    const fd = openSync(path, "r");
+    try {
+      return await fn(fd);
+    } finally {
+      closeSync(fd);
+    }
+  }
+
+  test("text() and arrayBuffer() on a regular-file fd return file contents", async () => {
+    using dir = tempDir("bun-file-fd-read", { "fd-read.txt": "hello from fd" });
+    const path = join(String(dir), "fd-read.txt");
+
+    // Each read needs a fresh fd because Bun.file(fd) does not own or rewind
+    // the descriptor, and a completed read leaves it positioned at EOF.
+    expect(await withFd(path, fd => Bun.file(fd).text())).toBe("hello from fd");
+
+    const buf = await withFd(path, fd => Bun.file(fd).arrayBuffer());
+    expect(new Uint8Array(buf)).toEqual(new TextEncoder().encode("hello from fd"));
+  });
+
+  test("slice() with an end beyond the real size reads the actual file contents", async () => {
+    using dir = tempDir("bun-file-fd-read", { "fd-slice.txt": "0123456789" });
+    const path = join(String(dir), "fd-slice.txt");
+
+    // total_size should come from fstat (10), not from the requested slice
+    // end, so the initial buffer allocation stays small.
+    expect(await withFd(path, fd => Bun.file(fd).slice(0, Number.MAX_SAFE_INTEGER).text())).toBe("0123456789");
+    expect(await withFd(path, fd => Bun.file(fd).slice(2, 5).text())).toBe("234");
+  });
+
+  test("empty regular file via fd resolves with empty content", async () => {
+    using dir = tempDir("bun-file-fd-read", { "fd-empty.txt": "" });
+    const path = join(String(dir), "fd-empty.txt");
+
+    expect(await withFd(path, fd => Bun.file(fd).text())).toBe("");
+    expect((await withFd(path, fd => Bun.file(fd).arrayBuffer())).byteLength).toBe(0);
+  });
+});