Skip to content

FileSystemRouter: build JS error before freeing arena in error paths - #29971

Merged
dylan-conway merged 4 commits into
mainfrom
farm/cf28ae20/fsr-log-uaf
May 1, 2026
Merged

FileSystemRouter: build JS error before freeing arena in error paths#29971
dylan-conway merged 4 commits into
mainfrom
farm/cf28ae20/fsr-log-uaf

FileSystemRouter: build JS error before freeing arena in error paths

4de46b9
Select commit
Loading
Failed to load commit list.
Claude / Claude Code Review completed Apr 30, 2026 in 11m 48s

Code review found 1 potential issue

Found 5 candidates, confirmed 1. See review comments for details.

Details

Severity Count
🔴 Important 0
🟡 Nit 0
🟣 Pre-existing 1
Severity File:Line Issue
🟣 Pre-existing src/bun.js/api/filesystem_router.zig:255-256 reload(): readDirInfo catch block leaks the new arena

Annotations

Check notice on line 256 in src/bun.js/api/filesystem_router.zig

See this annotation in the file changed.

@claude claude / Claude Code Review

reload(): readDirInfo catch block leaks the new arena

Pre-existing, not introduced here, but while you're normalizing arena lifetime around the `log.toJS` sites: the `readDirInfo` catch block in `reload()` (just above the `loadRoutes` catch you fixed) returns without `arena.deinit()` / `destroy(arena)`, leaking the freshly-created arena whenever `readDirInfo` errors. The adjacent `orelse` branch and the constructor's equivalent block both free it, so applying the same `const err_value = ...; arena.deinit(); destroy(arena); return throwValue(err_val