mirror of
https://github.com/vercel-labs/scriptc.git
synced 2026-10-21 05:50:55 +08:00
scr_console_capacity compared the raw tag with SCR_ARG_STR, but string parts of a concatenation argument carry SCR_ARG_GLUE. A glued string part therefore reserved only 32 bytes while scr_console_render, which masks with SCR_ARG_KIND, copied its full length, overflowing the on-stack (or heap) line buffer for any glued part longer than 32 bytes. Mask with SCR_ARG_KIND in the capacity loop and in the single-string fast path, the two remaining kind tests in scr_console.c. Tests: corpus 4296 logs template literals and `+` chains with glued string parts of 31..70000 bytes, several long parts per argument, and multi-byte UTF-8 parts. Before this change the --sanitize build aborted with an AddressSanitizer stack-buffer-overflow; it now matches Node in the plain and sanitized lanes.