fetch: accept HTTP/1.1 responses with more than 256 header fields - #34923
Open
robobun wants to merge 3 commits into
Open
fetch: accept HTTP/1.1 responses with more than 256 header fields#34923robobun wants to merge 3 commits into
robobun wants to merge 3 commits into
Claude / Claude Code Review
completed
Jul 21, 2026 in 20m 33s
Code review found 2 potential issues
Found 3 candidates, confirmed 2. See review comments for details.
Details
| Severity | Count |
|---|---|
| 🔴 Important | 0 |
| 🟡 Nit | 2 |
| 🟣 Pre-existing | 0 |
| Severity | File:Line | Issue |
|---|---|---|
| 🟡 Nit | src/http/lib.rs:3759-3766 |
Stale SAFETY comment on detach_lifetime() omits new overflow Vec backing store |
| 🟡 Nit | src/http/lib.rs:3759-3761 |
Overflow Vec sized to full-buffer newline count; retained at high-water mark |
Annotations
Check warning on line 3766 in src/http/lib.rs
claude / Claude Code Review
Stale SAFETY comment on detach_lifetime() omits new overflow Vec backing store
The `SAFETY` comment at [src/http/lib.rs:3801-3802](https://github.com/oven-sh/bun/blob/6e2b024886d9f89177e0100e16d7e68f4b5d03c3/src/http/lib.rs#L3801-L3802) for `unsafe { response.detach_lifetime() }` still says `response` borrows only `SHARED_RESPONSE_HEADERS_BUF / response_message_buffer`. On the new overflow path, `response.headers.list` instead borrows `SHARED_RESPONSE_HEADERS_OVERFLOW`'s heap buffer — whose element storage moves on the next `resize()`, so the "outlive this fn" phrasing no
Check warning on line 3761 in src/http/lib.rs
claude / Claude Code Review
Overflow Vec sized to full-buffer newline count; retained at high-water mark
The overflow Vec is sized to `count_char(to_read!(), b'\n')`, but `to_read!()` at this point is the whole receive buffer — including any body bytes that arrived in the same read — so a >256-field response followed by a newline-dense body in the same packet(s) can size the Vec far beyond the actual header count (each `picohttp::Header` slot is 32 bytes, and a ~1 MB buffer of mostly-`\n` bytes maps to ~10-16 MB of slots). `SHARED_RESPONSE_HEADERS_OVERFLOW` is a process-lifetime static that is only
Loading