Skip to content

fix(llm): reject oversized Bedrock event-stream frames - #44649

Closed
dajiaohuang wants to merge 1 commit into
anomalyco:devfrom
dajiaohuang:bedrock-frame-bounds
Closed

fix(llm): reject oversized Bedrock event-stream frames#44649
dajiaohuang wants to merge 1 commit into
anomalyco:devfrom
dajiaohuang:bedrock-frame-bounds

Conversation

@dajiaohuang

Copy link
Copy Markdown

Summary

AWS documents a 16 MiB maximum event-stream message. The frame prelude declares a 32-bit length, so a malformed response can declare up to 4 GiB. Nothing bounded the wait before this change, causing appendChunk to keep allocating and copying the accumulated buffer.

Problem

In packages/llm/src/protocols/bedrock-event-stream.ts, consumeFrames reads totalLength from the 4-byte frame prelude and loops until that many bytes have arrived. A malformed response can declare 0xFFFFFFFF (4 GiB). Because the buffer is only compacted once a frame completes, appendChunk re-copies the whole accumulated window on every network chunk. Cost is quadratic in bytes received.

AWS documents a 16 MiB maximum event-stream message; @smithy/eventstream-codec does not enforce it, and neither did we.

Fix

Add MAX_EVENT_STREAM_MESSAGE_LENGTH = 16 * 1024 * 1024 and reject frames that declare a larger length with a typed InvalidProviderOutput error instead of buffering toward a frame that can never complete.

Testing

sentwall (before)RSS (before)
8 MiB1.2 s134 MiB
16 MiB4.1 s166 MiB
32 MiB10.9 s262 MiB
64 MiB47.2 s650 MiB

After the fix, a frame declaring > 16 MiB immediately emits an error and stops buffering.

Fixes#44630

AWS documents a 16 MiB maximum event-stream message. The frame prelude
declares a 32-bit length, so a malformed response can declare up to 4 GiB.
Nothing bounded the wait before this change, causing appendChunk to keep
allocating and copying the accumulated buffer.
Add MAX_EVENT_STREAM_MESSAGE_LENGTH and reject frames that declare a
larger length with a typed error instead of buffering toward a frame
that can never complete.
Fixesanomalyco#44630
@github-actionsgithub-actionsBot added the needs:compliance This means the issue will auto-close after 2 hours. label Aug 24, 2026
@github-actions

Copy link
Copy Markdown
Contributor

This PR doesn't fully meet our contributing guidelines and PR template.

What needs to be fixed:

  • PR description is missing required template sections. Please use the PR template.

Please edit this PR description to address the above within 2 hours, or it will be automatically closed.

If you believe this was flagged incorrectly, please let a maintainer know.

@github-actions

Copy link
Copy Markdown
Contributor

The following comment was made by an LLM, it may be inaccurate:

Potential duplicate found:

This appears to be directly addressing the same issue as PR #44649. Both PRs are focused on rejecting oversized Bedrock event-stream frames that exceed the 16 MiB maximum documented by AWS. You should check if PR #44631 is already merged or if one of these should be closed in favor of the other.

@github-actions

Copy link
Copy Markdown
Contributor

This pull request has been automatically closed because it was not updated to meet our contributing guidelines within the 2-hour window.

Feel free to open a new pull request that follows our guidelines.

@github-actionsgithub-actionsBot removed the needs:compliance This means the issue will auto-close after 2 hours. label Aug 24, 2026
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Bedrock event-stream framing buffers without bound when a frame prelude declares an oversized length

1 participant

@dajiaohuang