Repository navigation
Check base64 without a backtracking regex - #1144
Merged
Merged
Conversation
normalizeBase64 tested multi-megabyte image strings with
/^[A-Za-z0-9+/]+={0,2}$/. V8 can overflow its stack backtracking through
that pattern, which failed the 12 MiB cap test in CI and would fail a
tool call returning a large image. Strip the padding by hand and look for
any character outside the alphabet with a single-character class instead;
same results on every padding case.
helpcodeai
enabled auto-merge (squash)
October 19, 2026 08:49
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The 0.38.0 release PR (#1143) failed in CI on
response-images.util.spec.ts› "caps the images of one result at 12 MiB together" withRangeError: Maximum call stack size exceededatBASE64.test(s)innormalizeBase64./^[A-Za-z0-9+/]+={0,2}$/on a 7 MB base64 string makes V8 keep a backtrack point per character, and depending on the stack left it overflows. The same thing can fail a real tool call that returns a large image (OpenAI/Gemini image tools).The check now strips up to two
=by hand and tests the rest with/[^A-Za-z0-9+/]/, a single-character class that never backtracks. Same answers as before on the padding edge cases (abcd,abc=,ab==,a===,====,ab=c, base64url after the-_swap). Existing response-images tests pass.