oracle / oracle/oci-typescript-sdk
[bug]: `getSignerAndReqBody` OOMs on `Buffer` bodies (misuses object-only `isEmpty`)
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 100
- Forks
- 64
- Avg merge
- 14m
- Merged PRs (30d)
- 5
Description
Package: oci-common · affects any operation sending a binary Buffer request body of more than a few MB (e.g. ObjectStorage.putObject, UploadManager single-part uploads).
helper.ts#L223 checks the body with isEmpty() before the string/Readable type branches below it:
if (!body || isEmpty(body)) { ... } // isEmpty = Object.keys(obj).length === 0
But isEmpty is documented for plain objects. When body is a Buffer (Uint8Array), Object.keys(body) materializes a string for every byte index — a ~20 MB body allocates ~20M strings synchronously → FATAL ERROR: Reached heap limit.
Crash stack:
Runtime_ObjectKeys → KeyAccumulator::GetKeys → TypedElementsAccessor::PrependElementIndices → SmiToString → OOMErrorHandler
Environment: container limited to 512 MB (V8 auto-sizes its heap to the cgroup limit), so the index-string burst exhausts the heap well before the body finishes enumerating.
Repro: putObject with a Buffer body of ~20 MB (or any UploadManager upload of a file at/below partSize, which is buffered into a single Buffer).
Fix: don't run the object-only isEmpty on a body — do the type-aware checks first (empty via .length/.byteLength for string/Buffer, and handle Buffer/ArrayBuffer.isView explicitly).
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at lib/common/lib/helper.ts line 223 and read lib/common/lib/utils.ts lines 18-21 to understand the object-only isEmpty check. Reproduce the issue with ObjectStorage.putObject or an UploadManager single-part upload using a large Buffer, then verify type-aware body checks avoid the heap exhaustion and preserve empty-body handling.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- nodejs, typescript
- Domain
- api, backend
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 78/100