diff --git a/src/paths/resolve_path.rs b/src/paths/resolve_path.rs
index 416ff9096931..8fbfd5ee54b2 100644
--- a/src/paths/resolve_path.rs
+++ b/src/paths/resolve_path.rs
@@ -12,13 +12,51 @@ use bun_core::{ZStr, strings};
// SAFETY invariant: each buffer has at most one live mutable borrow per thread;
// callers must not re-enter the accessor while a previous borrow is alive.
thread_local! {
- static PARSER_JOIN_INPUT_BUFFER: UnsafeCell<[u8; 4096]> = const { UnsafeCell::new([0u8; 4096]) };
+ static PARSER_JOIN_INPUT_BUFFER: LazyJoinBuf = const { LazyJoinBuf::NEW };
static PARSER_BUFFER: UnsafeCell<[u8; 1024]> = const { UnsafeCell::new([0u8; 1024]) };
}
+/// Output capacity of [`join_abs_string`] / [`join`]: at least `MAX_PATH_BYTES`
+/// (98 302 on Windows) so any valid host path fits; floored at 4096 on POSIX.
+pub(crate) const TL_JOIN_BUF_LEN: usize = if MAX_PATH_BYTES > 4096 {
+ MAX_PATH_BYTES
+} else {
+ 4096
+};
+
+/// Lazily heap-backed `[u8; TL_JOIN_BUF_LEN]` thread-local. 8 bytes in `.tls`
+/// instead of `TL_JOIN_BUF_LEN` zeros (PE/COFF has no TLS-BSS; see
+/// [`LazyPathBuf`]).
+struct LazyJoinBuf(core::cell::Cell<*mut [u8; TL_JOIN_BUF_LEN]>);
+
+impl LazyJoinBuf {
+ const NEW: Self = Self(core::cell::Cell::new(core::ptr::null_mut()));
+
+ /// Same single-live-borrow-per-thread contract as [`tl_buf_mut`].
+ #[inline]
+ fn get(&self) -> &'static mut [u8; TL_JOIN_BUF_LEN] {
+ let mut p = self.0.get();
+ if p.is_null() {
+ p = bun_core::heap::into_raw(bun_core::boxed_zeroed::<[u8; TL_JOIN_BUF_LEN]>());
+ self.0.set(p);
+ }
+ // SAFETY: non-null after init; thread-local ⇒ sole accessor.
+ unsafe { &mut *p }
+ }
+}
+
+impl Drop for LazyJoinBuf {
+ fn drop(&mut self) {
+ let p = self.0.get();
+ if !p.is_null() {
+ // SAFETY: `p` came from `heap::into_raw` in `get()`; sole accessor.
+ unsafe { drop(bun_core::heap::take(p)) };
+ }
+ }
+}
+
/// Project `&'static mut` into a thread-local `UnsafeCell<[u8; N]>` scratch
-/// buffer. One `unsafe` site for all `PARSER_BUFFER` / `PARSER_JOIN_INPUT_BUFFER`
-/// / `JOIN_BUF` accessors (nonnull-asref reduction: 6 sites → 1).
+/// buffer (`PARSER_BUFFER`).
///
/// The `'static` output lifetime is the honest contract: the buffer is
/// thread-local storage that lives for the thread's lifetime, and the returned
@@ -1354,7 +1392,7 @@ pub fn join_abs<'a, P: PlatformT>(cwd: &'a [u8], part: &[u8]) -> &'a [u8] {
// result borrows the thread-local buffer ('static) OR returns `cwd`
// directly when `parts.is_empty()`. Return tied to `cwd`'s lifetime ('static: 'a).
pub fn join_abs_string<'a, P: PlatformT>(cwd: &'a [u8], parts: &[&[u8]]) -> &'a [u8] {
- PARSER_JOIN_INPUT_BUFFER.with(|b| join_abs_string_buf::(cwd, tl_buf_mut(b), parts))
+ PARSER_JOIN_INPUT_BUFFER.with(|b| join_abs_string_buf::
(cwd, b.get(), parts))
}
/// Convert parts of potentially invalid file paths into a single valid filpeath
@@ -1363,22 +1401,19 @@ pub fn join_abs_string<'a, P: PlatformT>(cwd: &'a [u8], parts: &[&[u8]]) -> &'a
///
/// Returned path is stored in a temporary buffer. It must be copied if it needs to be stored.
pub fn join_abs_string_z<'a, P: PlatformT>(cwd: &'a [u8], parts: &[&[u8]]) -> &'a ZStr {
- PARSER_JOIN_INPUT_BUFFER.with(|b| join_abs_string_buf_z::
(cwd, tl_buf_mut(b), parts))
+ PARSER_JOIN_INPUT_BUFFER.with(|b| join_abs_string_buf_z::
(cwd, b.get(), parts))
}
-const JOIN_BUF_LEN: usize = 4096;
-
thread_local! {
- pub(crate) static JOIN_BUF: UnsafeCell<[u8; JOIN_BUF_LEN]> =
- const { UnsafeCell::new([0u8; JOIN_BUF_LEN]) };
+ static JOIN_BUF: LazyJoinBuf = const { LazyJoinBuf::NEW };
}
pub fn join(parts: &[&[u8]]) -> &'static [u8] {
- JOIN_BUF.with(|b| join_string_buf::(tl_buf_mut(b), parts))
+ JOIN_BUF.with(|b| join_string_buf::
(b.get(), parts))
}
pub fn join_z(parts: &[&[u8]]) -> &'static ZStr {
- JOIN_BUF.with(|b| join_z_buf::(tl_buf_mut(b), parts))
+ JOIN_BUF.with(|b| join_z_buf::
(b.get(), parts))
}
#[inline]
@@ -1409,7 +1444,7 @@ pub fn join_z_buf_spill<'a, P: PlatformT>(
/// `spill` (grown as needed). `spill` is untouched in the common case.
pub fn join_spill<'a, P: PlatformT>(spill: &'a mut Vec, parts: &[&[u8]]) -> &'a [u8] {
let needed = join_needed(parts);
- if needed <= JOIN_BUF_LEN {
+ if needed <= TL_JOIN_BUF_LEN {
return join::(parts);
}
if spill.len() < needed {
@@ -1422,7 +1457,7 @@ pub fn join_spill<'a, P: PlatformT>(spill: &'a mut Vec, parts: &[&[u8]]) ->
/// `spill` (grown as needed). `spill` is untouched in the common case.
pub fn join_z_spill<'a, P: PlatformT>(spill: &'a mut Vec, parts: &[&[u8]]) -> &'a ZStr {
let needed = join_needed(parts);
- if needed <= JOIN_BUF_LEN {
+ if needed <= TL_JOIN_BUF_LEN {
return join_z::(parts);
}
if spill.len() < needed {
@@ -2434,3 +2469,29 @@ pub fn posix_to_platform_in_place(path_buffer: &mut [T]) {
// `PathChar` is now canonical at `crate::path_char`; re-export for callers
// that still path through `resolve_path::PathChar`.
pub use crate::PathChar;
+
+#[cfg(test)]
+mod tests {
+ use super::*;
+
+ #[test]
+ fn tl_join_buf_len_holds_max_path_bytes() {
+ assert!(TL_JOIN_BUF_LEN >= MAX_PATH_BYTES);
+ assert!(TL_JOIN_BUF_LEN >= 4096);
+ }
+
+ #[test]
+ fn join_abs_string_accepts_path_buffer_length() {
+ // A valid host path just under MAX_PATH_BYTES round-trips through the TL buffer.
+ let long = vec![b'a'; MAX_PATH_BYTES - 8];
+ let cwd: &[u8] = if cfg!(windows) { b"C:\\d" } else { b"/d" };
+ let abs: &[u8] = if cfg!(windows) { b"C:\\" } else { b"/" };
+ let r = join_abs_string::(cwd, &[abs, &long]);
+ assert_eq!(r.len(), abs.len() + long.len());
+ let r = join_abs_string_z::(cwd, &[abs, &long]);
+ assert_eq!(r.as_bytes().len(), abs.len() + long.len());
+ // And the non-absolute `join` sibling backed by `JOIN_BUF`.
+ let r = join::(&[abs, &long]);
+ assert_eq!(r.len(), abs.len() + long.len());
+ }
+}
diff --git a/src/runtime/ffi/ffi_body.rs b/src/runtime/ffi/ffi_body.rs
index 72dc9e03d333..96744a35fa0c 100644
--- a/src/runtime/ffi/ffi_body.rs
+++ b/src/runtime/ffi/ffi_body.rs
@@ -1493,36 +1493,40 @@ impl FFI {
let dylib: bun_sys::DynLib = 'brk: {
// First try using the name directly
- match bun_sys::DynLib::open(name) {
- Ok(d) => break 'brk d,
- Err(_) => {
- let backup_name = Fs::FileSystem::instance().abs(&[name]);
- // if that fails, try resolving the filepath relative to the current working directory
- match bun_sys::DynLib::open(backup_name) {
- Ok(d) => break 'brk d,
- Err(_) => {
- // Then, if that fails, report an error with the library name and system error
- let dlerror_msg = get_dl_error();
-
- let mut msg = Vec::new();
- write!(
- &mut msg,
- "Failed to open library \"{}\": {}",
- BStr::new(name),
- BStr::new(&dlerror_msg)
- )
- .ok();
- let system_error = SystemError {
- code: bun_core::String::clone_utf8(b"ERR_DLOPEN_FAILED").into(),
- message: bun_core::String::clone_utf8(&msg).into(),
- syscall: bun_core::String::clone_utf8(b"dlopen").into(),
- ..Default::default()
- };
- return system_error.to_error_instance(global);
- }
- }
- }
+ if let Ok(d) = bun_sys::DynLib::open(name) {
+ break 'brk d;
+ }
+ // if that fails, try resolving the filepath relative to the current working directory
+ let mut backup_buf = bun_paths::path_buffer_pool::get();
+ if let Some(backup_name) =
+ Fs::FileSystem::instance().abs_buf_checked(&[name], &mut backup_buf[..])
+ && let Ok(d) = bun_sys::DynLib::open(backup_name)
+ {
+ break 'brk d;
}
+ // `DynLib::open` short-circuits ENAMETOOLONG without calling the
+ // loader, so dlerror()/GetLastError() is stale iff `name` was too long.
+ let dlerror_msg = if name.len() >= bun_paths::MAX_PATH_BYTES {
+ Box::<[u8]>::from(b"file name too long".as_slice())
+ } else {
+ get_dl_error()
+ };
+
+ let mut msg = Vec::new();
+ write!(
+ &mut msg,
+ "Failed to open library \"{}\": {}",
+ BStr::new(name),
+ BStr::new(&dlerror_msg)
+ )
+ .ok();
+ let system_error = SystemError {
+ code: bun_core::String::clone_utf8(b"ERR_DLOPEN_FAILED").into(),
+ message: bun_core::String::clone_utf8(&msg).into(),
+ syscall: bun_core::String::clone_utf8(b"dlopen").into(),
+ ..Default::default()
+ };
+ return system_error.to_error_instance(global);
};
let mut size = symbols.values().len();
diff --git a/test/js/bun/ffi/ffi-error-messages.test.ts b/test/js/bun/ffi/ffi-error-messages.test.ts
index 23cf35c76454..61bdce506e29 100644
--- a/test/js/bun/ffi/ffi-error-messages.test.ts
+++ b/test/js/bun/ffi/ffi-error-messages.test.ts
@@ -1,6 +1,6 @@
import { dlopen, linkSymbols } from "bun:ffi";
import { describe, expect, test } from "bun:test";
-import { isMusl } from "harness";
+import { bunEnv, bunExe, isMusl } from "harness";
describe("FFI error messages", () => {
test("dlopen shows library name when library cannot be opened", () => {
@@ -20,6 +20,44 @@ describe("FFI error messages", () => {
}
});
+ // dlopen falls back to FileSystem::abs() when the direct open fails; abs()
+ // writes into a thread-local buffer that was 4096 bytes on every platform.
+ // A library path longer than that used to abort with
+ // panic: range end index 5003 out of range for slice of length 4095
+ // instead of reporting the ordinary dlopen error. The "relative" row joins
+ // against cwd, so the overflow point is roughly MAX_PATH_BYTES - cwd.len().
+ test.concurrent.each([
+ ["absolute", 5000],
+ ["absolute", 100_000],
+ ["relative", 4090],
+ ["relative", 100_000],
+ ] as const)("dlopen with a %s %d-byte library path reports an error instead of aborting", async (kind, len) => {
+ const prefix = kind === "relative" ? "" : process.platform === "win32" ? "C:\\" : "/";
+ await using proc = Bun.spawn({
+ cmd: [
+ bunExe(),
+ "-e",
+ `const { dlopen } = require("bun:ffi");` +
+ `const name = ${JSON.stringify(prefix)} + Buffer.alloc(${len}, "a").toString() + ".so";` +
+ `try { dlopen(name, { f: { args: [], returns: "void" } }); }` +
+ `catch (e) { const m = String(e.message);` +
+ ` console.log("CAUGHT", e.code || e.name, m.slice(0, 30), "|", m.slice(-25)); }`,
+ ],
+ env: bunEnv,
+ stderr: "pipe",
+ });
+ const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+ expect({ stdout: stdout.trim(), stderr }).toEqual({
+ stdout: expect.stringMatching(/^CAUGHT ERR_DLOPEN_FAILED Failed to open library/),
+ stderr: "",
+ });
+ // 100k exceeds every platform's MAX_PATH_BYTES: the fallback is skipped
+ // and the reported reason is the ENAMETOOLONG from DynLib::open, not a
+ // stale dlerror()/GetLastError() ("unknown error" / "error code 0").
+ if (len === 100_000) expect(stdout).toContain("file name too long");
+ expect(exitCode).toBe(0);
+ });
+
test("dlopen shows which symbol is missing when symbol not found", () => {
// Use appropriate system library for the platform
const libName =
diff --git a/test/js/bun/http/bun-serve-html-manifest.test.ts b/test/js/bun/http/bun-serve-html-manifest.test.ts
index a1e5dbe29720..20734f07881e 100644
--- a/test/js/bun/http/bun-serve-html-manifest.test.ts
+++ b/test/js/bun/http/bun-serve-html-manifest.test.ts
@@ -266,6 +266,37 @@ describe("Bun.serve HTML manifest", () => {
expect(out).toContain("SUCCESS: Manifest validation failed as expected");
});
+ it("rejects a manifest file path longer than the join buffer without aborting", async () => {
+ // Windows MAX_PATH_BYTES (98302) >> 4096, so a 5000-byte path passes the
+ // ENAMETOOLONG guard and reaches FileSystem::abs() whose output buffer was
+ // 4096 bytes: process used to abort with a slice-index panic. On POSIX
+ // MAX_PATH_BYTES <= 4096, so the guard rejects it with ENAMETOOLONG first.
+ await using proc = Bun.spawn({
+ cmd: [
+ bunExe(),
+ "-e",
+ `const long = (process.platform === "win32" ? "C:\\\\" : "/") + Buffer.alloc(5000, "a").toString();` +
+ `try {` +
+ ` const s = Bun.serve({ port: 0, routes: { "/": {` +
+ ` index: "./index.html",` +
+ ` files: [{ input: "index.html", path: long, loader: "html", isEntry: true,` +
+ ` headers: { etag: "x", "content-type": "text/html" } }],` +
+ ` } } });` +
+ ` s.stop();` +
+ ` console.log("CAUGHT no-throw");` +
+ `} catch (e) { console.log("CAUGHT", e.code || e.name); }`,
+ ],
+ env: bunEnv,
+ stderr: "pipe",
+ });
+ const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+ // ENAMETOOLONG on POSIX (the per-part guard fires); ERR_INVALID_ARG_TYPE
+ // on Windows (abs() succeeds; route setup then rejects the missing file).
+ if (!stdout.startsWith("CAUGHT")) console.error(stderr);
+ expect(stdout.trim()).toMatch(/^CAUGHT (ENAMETOOLONG|ERR_INVALID_ARG_TYPE)$/);
+ expect(exitCode).toBe(0);
+ });
+
it("serves manifest with proper headers", async () => {
await using dir = tempDir("serve-html-headers", {
"server.ts": `