René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"zlib: strictly validate Zstd pledgedSrcSize","articleBody":"### Version\n\nlatest main branch\n\n### Platform\n\n```text\n7.1.3-arch1-3\n```\n\n### Subsystem\n\nzlib\n\n### What steps will reproduce the bug?\n\n```js\n  const zlib = require('node:zlib');\n\n  const cases = [\n    {\n      label: 'string',\n      pledgedSrcSize: '1',\n      input: Buffer.alloc(42),\n    },\n    {\n      label: 'null',\n      pledgedSrcSize: null,\n      input: Buffer.alloc(42),\n    },\n    {\n      label: 'fractional',\n      pledgedSrcSize: 1.9,\n      input: Buffer.alloc(1),\n    },\n    {\n      label: 'NaN',\n      pledgedSrcSize: NaN,\n      input: Buffer.alloc(0),\n    },\n    {\n      label: 'Infinity',\n      pledgedSrcSize: Infinity,\n      input: Buffer.alloc(0),\n    },\n    {\n      label: 'unsafe integers',\n      pledgedSrcSize: Number.MAX_SAFE_INTEGER + 1,\n      input: Buffer.alloc(0),\n    },\n  ];\n\n  for (const { label, pledgedSrcSize, input } of cases) {\n    try {\n      zlib.zstdCompressSync(input, { pledgedSrcSize });\n      console.log(`${label}: accepted`);\n    } catch (error) {\n      console.log(`${label}: ${error.code}`);\n    }\n  }\n```\n\n### How often does it reproduce? Is there a required condition?\n\nEvery time\n\n### What is the expected behavior? Why is that the expected behavior?\n\npledgedSrcSize represents the expected exact byte length of the uncompressed input. However, the current Zstd binding does not strictly validate this option.Non-number values are silently treated as if the option was omitted, while IntegerValue() implicitly converts values such as fractional numbers and NaN.\n\n### What do you see instead?\n\n  string: accepted\n  null: accepted\n  fraction: accepted\n  NaN: accepted\n  Infinity: ZSTD_error_srcSize_wrong\n  unsafe integer: ZSTD_error_srcSize_wrong\n\n### Additional information\n\n  Only undefined or a non-negative safe integer should be accepted.\n\n  - Non-number values should throw ERR_INVALID_ARG_TYPE.\n  \n  - NaN, Infinity, fractional numbers, negative numbers, and unsafe integers should throw ERR_OUT_OF_RANGE.\n  \n  - Invalid options should be rejected during argument validation rather than producing a later ZSTD_error_srcSize_wrong.\n\nValues above Number.MAX_SAFE_INTEGER should not be accepted because JavaScript cannot represent every integer in that range precisely, while the pledged size represents an exact byte count.","author":{"url":"https://github.com/Archkon","@type":"Person","name":"Archkon"},"datePublished":"2026-07-19T16:17:26Z","url":"https://github.com/nodejs/node/issues/64603"}