Bound Brotli parameter names in error messages

packages/compiler/test/ts7/baselines/order-parity/tests/corpus/8129-brotli-long-param-name.cjs.json

@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/8129-brotli-long-param-name.cjs"
+ ],
+ "diags": []
+}

packages/runtime/src/scr_brotli.c

@@ -161,10 +161,16 @@ static uint32_t scr_brotli_uint32(const ScrDyn *v) {
   return (uint32_t)m;
 }
 
+/* ERR_BROTLI_INVALID_PARAM: the whole key, then Node's text. */
 static void scr_brotli_invalid_param(const ScrStr *key) {
-  char message[160];
-  int n = snprintf(message, sizeof message, "%.*s is not a valid Brotli parameter", (int)key->len, key->data);
-  scr_throw_error_msg_code(SCR_ERR_RANGE, message, (size_t)n, "ERR_BROTLI_INVALID_PARAM");
+  static const char suffix[] = " is not a valid Brotli parameter";
+  size_t len = key->len + sizeof suffix - 1;
+  char *message = malloc(len);
+  if (!message) scr_brotli_oom();
+  memcpy(message, key->data, key->len);
+  memcpy(message + key->len, suffix, sizeof suffix - 1);
+  scr_throw_error_msg_code(SCR_ERR_RANGE, message, len, "ERR_BROTLI_INVALID_PARAM");
+  free(message);
 }
 
 /* opts.params: each own key must name a parameter (0..8) once, and each

packages/runtime/test/common-symbols.test.ts

@@ -38,6 +38,7 @@ async function commonSymbols(label: string, compiler: string[]): Promise<string[
         ...defines,
         `-I${join(vendorDir, "quickjs-ng")}`,
         `-I${join(vendorDir, "mbedtls", "include")}`,
+        `-I${join(vendorDir, "brotli", "c", "include")}`,
         "-o",
         output,
         join(srcDir, name),

tests/corpus/8129-brotli-long-param-name.cjs

@@ -0,0 +1,23 @@
+// A Brotli params key that names no parameter: ERR_BROTLI_INVALID_PARAM
+// carries the whole key, however long, in Node's message.
+const zlib = require("node:zlib");
+for (const key of ["k".repeat(5000), "é".repeat(300) + "x", "9", "-1", "1.5", "x"]) {
+  try {
+    zlib.brotliCompressSync("data", { params: { [key]: 1 } });
+    console.log("accepted", key.length);
+  } catch (err) {
+    const suffix = " is not a valid Brotli parameter";
+    console.log(
+      err.name,
+      err.code,
+      err.message.length,
+      err.message === key + suffix,
+      err.message.slice(-suffix.length - 3),
+    );
+  }
+}
+try {
+  zlib.createBrotliDecompress({ params: { ["p".repeat(100000)]: 0 } });
+} catch (err) {
+  console.log(err.name, err.code, err.message.length, err.message.startsWith("pppp"));
+}

tests/harness/corpus-costs/8129-brotli-long-param-name.cjs.json

@@ -0,0 +1 @@
+{ "plain": 7006, "san": 14012 }