Hardening: fix crashes across the runtime, bundler, dev server, shell and CLI

docs/project/bindgen.mdx

@@ -448,7 +448,8 @@ thread.
 **A shared buffer** is borrowed like any other, as JSC's own `toBase64` and `indexOf` read one, and
 another thread that writes it during the call changes what the body reads. `shared: "copied"` is
 for a body that reads a byte again and counts on what it was, such as a parser that scans ahead
-and comes back. JSC's `sort` copies for the same reason.
+and comes back. JSC's `sort` copies for the same reason. With `string: "asIs"` the body calls
+`JsBytes::get_or_copy_if_shared` instead.
 
 The kind of the value is checked, and a string converted, in the order of the arguments. The
 bytes of a buffer are read, copied or pinned after every argument is converted. It is not a

docs/runtime/http/websockets.mdx

@@ -357,7 +357,7 @@ ws.terminate(); // no Close frame
 - `0`, `1005` and `1006` send a Close frame with no code, so you can forward the code from a `close` handler to another socket.
 - The reason is truncated to 123 bytes of UTF-8.
 
-When the client violates the protocol, Bun sends a Close frame with `1002` (protocol error), `1007` (invalid UTF-8 or compressed data) or `1009` (message too big). The `close` handler receives `1006`, with a description of the problem as the reason.
+When the client violates the protocol, Bun sends a Close frame with `1002` (protocol error), `1007` (invalid UTF-8 or compressed data) or `1009` (message too big). If a buffer for a message cannot be allocated, Bun sends `1011` and closes that connection only. The `close` handler receives `1006`, with a description of the problem as the reason.
 
 `server.stop()` doesn't close open WebSockets. `server.stop(true)` closes each one with `1001`.
 

packages/bun-types/ffi.d.ts

@@ -536,7 +536,8 @@ declare module "bun:ffi" {
      *
      * Once called, the library is no longer usable.
      *
-     * Calling a function from a library that has been closed is undefined behavior.
+     * Calling a symbol from a closed {@link cc} library throws a `TypeError`.
+     * Calling a symbol from a closed {@link dlopen} or {@link linkSymbols} library is undefined behavior.
      */
     close(): void;
   }

packages/bun-types/jsc.d.ts

@@ -802,7 +802,8 @@ declare module "bun:jsc" {
    * value, use {@link profile} instead.
    *
    * @param optionalDirectory A directory to write a text report of the hottest
-   * functions and bytecodes into when the process exits. Created if it does not exist.
+   * functions and bytecodes to when the process (or the calling worker) exits.
+   * The directory is created if it doesn't exist.
    * @param sampleInterval How often to sample the stack, in microseconds. Defaults to 1000 (once a millisecond).
    */
   function startSamplingProfiler(optionalDirectory?: string, sampleInterval?: number): void;

packages/bun-usockets/src/context.c

@@ -74,6 +74,17 @@ void us_socket_group_deinit(struct us_socket_group_t *group) {
  * closes it in finalize(), so closing+freeing it here turns that into a UAF
  * (the original LSAN was only the *accepted* sockets, not the listener). */
 void us_socket_group_close_all_ex(struct us_socket_group_t *group, int also_listeners) {
+    struct us_loop_t *loop = group->loop;
+    if (!loop) {
+        /* A Windows named-pipe Listener never initializes its group. */
+        return;
+    }
+
+    /* A close handler can tick the loop (waitForPromise). Bump tick_depth so
+     * that nested tick doesn't free the sockets closed here while this loop and
+     * Listener.stop still read them. */
+    loop->data.tick_depth++;
+
     if (also_listeners) {
         /* Listeners first — stops new sockets from being accepted into
          * head_sockets while we're draining it. */
@@ -141,6 +152,8 @@ void us_socket_group_close_all_ex(struct us_socket_group_t *group, int also_list
         }
         US_ASSERT(group->low_prio_count == 0);
     }
+
+    loop->data.tick_depth--;
 }
 
 void us_socket_group_close_all(struct us_socket_group_t *group) {
@@ -464,7 +477,7 @@ void us_listen_socket_close(struct us_listen_socket_t *ls) {
         struct us_socket_group_t *group = ls->accept_group;
         struct us_loop_t *loop = s->group->loop;
         us_poll_stop((struct us_poll_t *) s, loop);
-        bsd_close_socket(us_poll_fd((struct us_poll_t *) s));
+        us_internal_poll_close_fd((struct us_poll_t *) s);
 
         us_internal_listen_socket_ssl_free(ls);
 

packages/bun-usockets/src/crypto/openssl.c

@@ -127,7 +127,6 @@ enum {
 /* SNI tree leaf — stored as the void* user in sni_tree.cpp. */
 struct sni_node_t {
   SSL_CTX *ctx;
-  void *user;
 };
 
 static _Atomic long ssl_ctx_live = 0;
@@ -140,7 +139,6 @@ long us_ssl_ctx_live_count(void) {
  *   - us_ctx_ex_idx (SSL_CTX): packed reneg {limit:u32,window:u32}; its
  *     free_func also decrements ssl_ctx_live so the counter tracks ACTUAL
  *     destruction (refcount→0), not every SSL_CTX_free.
- *   - us_sni_ex_idx (SSL_CTX): per-domain userdata (uWS HttpRouter*).
  *   - us_ssl_rare_ex_idx (SSL): us_ssl_rare_t.
  *   - us_ssl_wrapper_ex_idx (SSL): the owner of an SSL that no us_socket_t drives.
  *
@@ -151,7 +149,6 @@ long us_ssl_ctx_live_count(void) {
  * internal-only, so use the platform primitive directly; root_certs.cpp does
  * the same via std::call_once.) */
 static int us_ctx_ex_idx = -1;
-static int us_sni_ex_idx = -1;
 static int us_ctx_cache_ex_idx = -1;
 /* Marks an SSL_CTX whose verification store holds user-provided CAs (the
  * ca/caFile options or a later addCACert): the per-socket client attach must
@@ -373,7 +370,6 @@ extern void bun_ssl_ctx_cache_on_free(void *parent, void *ptr, CRYPTO_EX_DATA *a
 
 static void us_ex_idx_init(void) {
   us_ctx_ex_idx = SSL_CTX_get_ex_new_index(0, NULL, NULL, NULL, us_ctx_ex_free);
-  us_sni_ex_idx = SSL_CTX_get_ex_new_index(0, NULL, NULL, NULL, NULL);
   us_ctx_cache_ex_idx = SSL_CTX_get_ex_new_index(0, NULL, NULL, NULL, bun_ssl_ctx_cache_on_free);
   us_ctx_user_ca_ex_idx = SSL_CTX_get_ex_new_index(0, NULL, NULL, NULL, NULL);
   us_ctx_sni_policy_ex_idx = SSL_CTX_get_ex_new_index(0, NULL, NULL, NULL, NULL);
@@ -3394,7 +3390,7 @@ static int sni_cb(SSL *ssl, int *al, void *arg) {
 
 void us_listen_socket_add_server_name(struct us_listen_socket_t *ls,
                                       const char *hostname_pattern,
-                                      SSL_CTX *ctx, void *user) {
+                                      SSL_CTX *ctx) {
   SSL_CTX *default_ctx = ls->ssl_ctx;
   if (!default_ctx) return;
 
@@ -3408,22 +3404,11 @@ void us_listen_socket_add_server_name(struct us_listen_socket_t *ls,
 
   struct sni_node_t *node = us_malloc(sizeof(struct sni_node_t));
   node->ctx = ctx;
-  node->user = user;
   SSL_CTX_up_ref(ctx);
-  /* Stash userdata on the SSL_CTX too so per-socket lookup via
-   * SSL_get_SSL_CTX works regardless of which ctx the SNI cb selected. */
-  us_ex_idx_ensure();
-  SSL_CTX_set_ex_data(ctx, us_sni_ex_idx, user);
 
   sni_node_destructor(sni_add(names->tree, hostname_pattern, node));
 }
 
-void *us_listen_socket_find_server_name_userdata(struct us_listen_socket_t *ls,
-                                                 const char *hostname_pattern) {
-  struct sni_node_t *node = us_server_names_find(ls->server_names, hostname_pattern);
-  return node ? node->user : NULL;
-}
-
 /* Returns the SSL_CTX registered for `hostname_pattern` via
  * us_listen_socket_add_server_name, or NULL. Owned - the caller must release
  * the reference. The on_server_name resolvers return owned references (the
@@ -3481,11 +3466,6 @@ void us_socket_on_server_name(struct us_socket_t *s) {
   if (ctx) SSL_CTX_set_select_certificate_cb(ctx, us_select_cert_cb);
 }
 
-void *us_socket_server_name_userdata(struct us_socket_t *s) {
-  if (!s->ssl || !s_ssl(s) || us_sni_ex_idx < 0) return NULL;
-  return SSL_CTX_get_ex_data(SSL_get_SSL_CTX(s_ssl(s)), us_sni_ex_idx);
-}
-
 const char *us_internal_ssl_sni_servername(struct us_socket_t *s) {
   if (!s->ssl || !s_ssl(s)) return NULL;
   return SSL_get_servername(s_ssl(s), TLSEXT_NAMETYPE_host_name);

packages/bun-usockets/src/eventing/epoll_kqueue.c

@@ -786,6 +786,10 @@ void us_poll_stop(struct us_poll_t *p, struct us_loop_t *loop) {
     us_internal_loop_update_pending_ready_polls(loop, p, 0, old_events, new_events);
 }
 
+void us_internal_poll_close_fd(struct us_poll_t *p) {
+    bsd_close_socket(us_poll_fd(p));
+}
+
 size_t us_internal_accept_poll_event(struct us_poll_t *p) {
 #ifdef LIBUS_USE_EPOLL
     int fd = us_poll_fd(p);