fix(binding): reject oversized final-value allocations

internal/binding/output.go

@@ -160,9 +160,21 @@ func convertFloat(value starlark.Float) (any, error) {
 	return float, nil
 }
 
+// containerLength returns length when that many child nodes fit the remaining budget.
+func (converter *finalConverter) containerLength(length int) (int, error) {
+	if length > converter.remainingNodes {
+		return 0, fmt.Errorf("%w: value exceeds byte-derived node budget", ErrValueLimit)
+	}
+	return length, nil
+}
+
 // convertTuple recursively converts an immutable sequence.
 func (converter *finalConverter) convertTuple(value starlark.Tuple, depth int) ([]any, error) {
-	items := make([]any, len(value))
+	length, err := converter.containerLength(len(value))
+	if err != nil {
+		return nil, err
+	}
+	items := make([]any, length)
 	for index, item := range value {
 		converted, err := converter.convert(item, depth+1)
 		if err != nil {
@@ -181,7 +193,11 @@ func (converter *finalConverter) convertList(value *starlark.List, depth int) ([
 	}
 	defer converter.leave(key)
 
-	items := make([]any, 0, value.Len())
+	length, err := converter.containerLength(value.Len())
+	if err != nil {
+		return nil, err
+	}
+	items := make([]any, 0, length)
 	iterator := value.Iterate()
 	defer iterator.Done()
 	var item starlark.Value
@@ -203,13 +219,27 @@ func (converter *finalConverter) convertDict(value *starlark.Dict, depth int) (m
 	}
 	defer converter.leave(key)
 
-	object := make(map[string]any, value.Len())
-	for _, item := range value.Items() {
-		name, ok := starlark.AsString(item[0])
+	length, err := converter.containerLength(value.Len())
+	if err != nil {
+		return nil, err
+	}
+	object := make(map[string]any, length)
+	iterator := value.Iterate()
+	defer iterator.Done()
+	var dictKey starlark.Value
+	for iterator.Next(&dictKey) {
+		name, ok := starlark.AsString(dictKey)
 		if !ok {
 			return nil, fmt.Errorf("%w: dictionary key must be a string", ErrUnsupportedValue)
 		}
-		converted, err := converter.convert(item[1], depth+1)
+		item, found, err := value.Get(dictKey)
+		if err != nil {
+			return nil, fmt.Errorf("%w: dictionary lookup: %w", ErrUnsupportedValue, err)
+		}
+		if !found {
+			return nil, fmt.Errorf("%w: missing dictionary value", ErrUnsupportedValue)
+		}
+		converted, err := converter.convert(item, depth+1)
 		if err != nil {
 			return nil, err
 		}

internal/binding/output_test.go

@@ -3,6 +3,9 @@ package binding
 import (
 	"math"
 	"math/big"
+	"runtime"
+	"runtime/debug"
+	"strconv"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -180,3 +183,81 @@ func TestConvertFinalBoundsSharedSubstructure(t *testing.T) {
 	require.ErrorIs(t, err, ErrValueLimit)
 	assert.Contains(t, err.Error(), "node budget")
 }
+
+// TestConvertFinalRejectsOversizedContainersBeforeAllocation proves oversized
+// tuple, list, and dictionary sources are rejected before destination materialization.
+func TestConvertFinalRejectsOversizedContainersBeforeAllocation(t *testing.T) {
+	const (
+		sourceLen     = 128_000
+		maxDepth      = 4
+		maxBytes      = 1024
+		maxAllocBytes = 1 << 20
+	)
+
+	item := starlark.String("x")
+	tuple := make(starlark.Tuple, sourceLen)
+	listItems := make([]starlark.Value, sourceLen)
+	for index := range sourceLen {
+		tuple[index] = item
+		listItems[index] = item
+	}
+	list := starlark.NewList(listItems)
+
+	dictionary := starlark.NewDict(sourceLen)
+	for index := range sourceLen {
+		require.NoError(t, dictionary.SetKey(starlark.String(strconv.Itoa(index)), item))
+	}
+
+	tests := []struct {
+		// name identifies the oversized container kind.
+		name string
+
+		// value is the prebuilt source presented for final conversion.
+		value starlark.Value
+	}{
+		{name: "tuple", value: tuple},
+		{name: "list", value: list},
+		{name: "dictionary", value: dictionary},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			allocated, err := measureConvertFinalGrowth(t, tt.value, maxDepth, maxBytes)
+
+			require.Error(t, err)
+			require.ErrorIs(t, err, ErrValueLimit)
+			assert.Contains(t, err.Error(), "value exceeds byte-derived node budget")
+			assert.LessOrEqual(
+				t,
+				allocated,
+				uint64(maxAllocBytes),
+				"ConvertFinal allocated %d bytes converting an oversized %s; destination materialization must not scale with source length %d",
+				allocated,
+				tt.name,
+				sourceLen,
+			)
+			runtime.KeepAlive(tt.value)
+		})
+	}
+
+	runtime.KeepAlive(tests)
+}
+
+// measureConvertFinalGrowth reports heap bytes allocated by ConvertFinal.
+//
+// Automatic GC is disabled only for the measured call so TotalAlloc reflects
+// conversion work rather than concurrent collection, then the previous GC
+// percent is restored.
+func measureConvertFinalGrowth(t *testing.T, value starlark.Value, maxDepth int, maxBytes int) (uint64, error) {
+	t.Helper()
+
+	previousGCPercent := debug.SetGCPercent(-1)
+	defer debug.SetGCPercent(previousGCPercent)
+
+	var before, after runtime.MemStats
+	runtime.ReadMemStats(&before)
+	_, err := ConvertFinal(value, maxDepth, maxBytes)
+	runtime.ReadMemStats(&after)
+	runtime.KeepAlive(value)
+	return after.TotalAlloc - before.TotalAlloc, err
+}