From 402a02fe2bdd8b591e0b2ebc5b27d76e82b53b07 Mon Sep 17 00:00:00 2001
From: Haram Jeong <91401364+haramj@users.noreply.github.com>
Date: Tue, 9 Sep 2025 09:36:14 +0900
Subject: [PATCH] assert: cap input size in myersDiff to avoid Int32Array
 overflow

PR-URL: https://github.com/nodejs/node/pull/59578
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
---
 lib/internal/assert/myers_diff.js       | 16 +++++++++++++++-
 test/parallel/test-assert-myers-diff.js | 25 +++++++++++++++++++++++++
 2 files changed, 40 insertions(+), 1 deletion(-)
 create mode 100644 test/parallel/test-assert-myers-diff.js

diff --git a/lib/internal/assert/myers_diff.js b/lib/internal/assert/myers_diff.js
index 6fcfc4e844..ee6359042e 100644
--- a/lib/internal/assert/myers_diff.js
+++ b/lib/internal/assert/myers_diff.js
@@ -6,6 +6,12 @@ const {
   StringPrototypeEndsWith,
 } = primordials;
 
+const {
+  codes: {
+    ERR_OUT_OF_RANGE,
+  },
+} = require('internal/errors');
+
 const colors = require('internal/util/colors');
 
 const kNopLinesToCollapse = 5;
@@ -29,7 +35,15 @@ function myersDiff(actual, expected, checkCommaDisparity = false) {
   const actualLength = actual.length;
   const expectedLength = expected.length;
   const max = actualLength + expectedLength;
-  // TODO(BridgeAR): Cap the input in case the values go beyond the limit of 2^31 - 1.
+
+  if (max > 2 ** 31 - 1) {
+    throw new ERR_OUT_OF_RANGE(
+      'myersDiff input size',
+      '< 2^31',
+      max,
+    );
+  }
+
   const v = new Int32Array(2 * max + 1);
   const trace = [];
 
diff --git a/test/parallel/test-assert-myers-diff.js b/test/parallel/test-assert-myers-diff.js
new file mode 100644
index 0000000000..31db3cd704
--- /dev/null
+++ b/test/parallel/test-assert-myers-diff.js
@@ -0,0 +1,25 @@
+// Flags: --expose-internals
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+
+const { myersDiff } = require('internal/assert/myers_diff');
+
+{
+  const arr1 = { length: 2 ** 31 - 1 };
+  const arr2 = { length: 2 };
+  const max = arr1.length + arr2.length;
+  assert.throws(
+    () => {
+      myersDiff(arr1, arr2);
+    },
+    common.expectsError({
+      code: 'ERR_OUT_OF_RANGE',
+      name: 'RangeError',
+      message: 'The value of "myersDiff input size" ' +
+                'is out of range. It must be < 2^31. ' +
+                `Received ${max}`
+    })
+  );
+}