fix(od): bound row widths and budget output growth

[chaliy]

What changed

od rejects -w/--width above 65,536 bytes before rendering, including empty input. It pads each numeric field in an eight-byte stack buffer instead of allocating an entire requested-width row. Output uses existing budgeted, fallible growth; rendering consumes the shared work budget. Padding arithmetic remains safe on 32-bit targets.

Why

An untrusted script could request a 2^60-byte allocation with one byte of input. Allocation failure can abort the embedding process; timeout and panic recovery cannot contain that failure. This fixes Codex Security finding commit:beb2051713d48191994f971d65a5f6fd.

Before / After

Before: two safe regressions failed against the pre-fix implementation: width 65,538 exited successfully, and a 65,536-byte trailer row bypassed a 4 KiB live-memory budget. The destructive allocation was not executed.

After, actual CLI smoke:

$ bashkit --no-stdin -c 'printf x | od -w1152921504606846976'
od: width exceeds maximum of 65536 bytes
exit: 1; stdout: empty

$ bashkit --no-stdin -c 'printf abc | od -tx2z'
0000000 6261 0063                                >abc<
0000003
exit: 0

Regression coverage: decimal/octal/hex/multiplier enormous widths, empty input, multiple types, exact ceiling, tight live/work budgets, recovery, and output above the capture cap flowing through pipelines. A portable GNU differential test compares 21 valid-width layout cases on Linux; local macOS lacks GNU od.

Validation: HTTP-feature workspace tests (excluding the unchanged CPython artifact crate), 19 single-threaded failpoint tests, all-feature clippy, knowledge/documentation checks, and both benchmark harnesses. Full performance harness: 96 cases, zero errors, 100% output match.

Local limitations: default-stack just pre-pr aborts in the existing nested-if parser test, reproduced on unchanged main daae80ac6a3f2e2a316e61ef9726bea02f63c9d5. With 8 MiB test-thread stacks all core integration tests pass, but full pre-pr reaches the unchanged CPython module's 64 KiB alignment assertion, also reproduced in isolation. No runtime limits, assertions, or CI gates were changed. Full Linux CI must pass before merge.

Zero/misaligned-width safety is tested directly: GNU od can abort on -w0, so invalid widths are excluded from the external oracle. The initial CI failure exposed this oracle failure; assertions and runtime protections remain intact.

Risk

Low. Widths above 65,536 bytes are an intentional sandbox restriction, documented as L-OD-002. Ordinary GNU layouts and pipeline behavior are preserved. No dependency changes.

Checklist

• Tests added or updated
• Backward compatibility considered

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	bashkit	05dae69	Commit Preview URL Branch Preview URL	Oct 08 2026, 02:12 AM