{"record":{"id":"e833fd2b3a7e71f4","repo":"swc-project/swc","slug":"should-be-able-to-convert-size","errorCode":null,"errorMessage":"Should be able to convert size","messagePattern":"Should be able to convert size","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/swc_plugin_runner/src/memory_interop.rs","lineNumber":56,"sourceCode":"        .expect(\"Should able to write into memory view\");\n\n    (ptr_start, serialized_size)\n}\n\n/// Set `return` value to pass into guest from functions returning values with\n/// non-deterministic size like `Vec<Comment>`. Guest pre-allocates a struct to\n/// contain ptr to the value, host in here allocates guest memory for the actual\n/// value then returns its ptr with length to the preallocated struct.\n#[cfg_attr(debug_assertions, tracing::instrument(level = \"info\", skip_all))]\npub fn allocate_return_values_into_guest(\n    caller: &mut dyn runtime::Caller<'_>,\n    allocated_ret_ptr: u32,\n    serialized_bytes: &PluginSerializedBytes,\n) {\n    let serialized_bytes_len: usize = serialized_bytes.as_slice().len();\n    let serialized_bytes_len = serialized_bytes_len\n        .try_into()\n        .expect(\"Should be able to convert size\");\n\n    // In most cases our host-plugin trampoline works in a way that\n    // plugin pre-allocates\n    // memory before calling host imported fn. But in case of\n    // comments return value is Vec<Comments> which\n    // guest cannot predetermine size to allocate, instead\n    // let host allocate by calling guest's alloc via attached\n    // hostenvironment.\n    let guest_memory_ptr = caller\n        .alloc(serialized_bytes_len)\n        .expect(\"Should able to allocate memory in the plugin\");\n\n    let (allocated_ptr, allocated_ptr_len) =\n        write_into_memory_view(caller, serialized_bytes, |_, _| guest_memory_ptr);\n\n    // We cannot use cbor serialization because it is a variable-length encoding.\n    let allocated_fatptr = {\n        let allocated_ptr = allocated_ptr.to_le_bytes();","sourceCodeStart":38,"sourceCodeEnd":74,"githubUrl":"https://github.com/swc-project/swc/blob/5176682b65416c6b5de6b47379ae1588ea3ecb3f/crates/swc_plugin_runner/src/memory_interop.rs#L38-L74","documentation":"In allocate_return_values_into_guest, the byte length of the serialized return value (typically Vec<Comment> for the comments proxy) is converted from usize into the 32-bit size accepted by the guest allocator. The expect panics when that serialized blob exceeds the 32-bit range (~2-4 GiB), which is effectively unreachable for comment data but possible with pathological inputs.","triggerScenarios":"A host import returns a value with non-deterministic size (comments proxy enabled) whose serialized bytes exceed i32/u32 range, then the host calls caller.alloc with that size.","commonSituations":"Files with enormous comment volumes (machine-generated license headers, commented data blobs) processed by plugins with the comments proxy enabled; practically a guard against absurd sizes.","solutions":["Reduce comment volume or disable comment preservation (jsc.transform.legacyDecorator/Comments handling) for machine-generated files.","Strip comments before the plugin pass if comments are not needed.","Report upstream if hit with a legitimate input - the conversion should surface as an error, not a panic."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Comments-proxy return payloads scale with comment volume; strip or cap\n// before enabling plugins on machine-generated files.\nfn plugin_safe_for_input(src: &str) -> bool {\n    src.len() < 32 * 1024 * 1024 && src.matches(\"//\").count() < 100_000\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Disable comment preservation for machine-generated inputs when plugins run.","Keep the comments proxy off unless the plugin genuinely needs comments.","Report upstream if a realistic comment volume triggers the panic; conversion should be an error, not a panic."],"tags":["integer-overflow","plugin","comments","panic"],"backgroundTag":"integer-conversion-overflow","analyzedSha":"5176682b65416c6b5de6b47379ae1588ea3ecb3f","analyzedAt":"2026-08-17T16:16:52.067Z","contentChangedAt":"2026-08-17T16:16:52.067Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}