From 87a5ab0c689efce1cf99a7af2c833eba3e537871 Mon Sep 17 00:00:00 2001
From: VirajMishra1 <viraj.mishra.81@gmail.com>
Date: Thu, 3 Sep 2026 09:58:18 -0400
Subject: [PATCH] inspector: fix ctype UB, stoi overflow, WebSocket frame
 bounds

- inspector_io.cc: cast isdigit arg to unsigned char (signed UB)
- inspector_io.cc: replace stoi with from_chars (no-exceptions build)
- inspector_io.cc: cast to unsigned int before left-shift (UB)
- inspector_socket.cc: fix WebSocket frame bounds check

Signed-off-by: VirajMishra1 <viraj.mishra.81@gmail.com>
---
 src/inspector_io.cc     | 13 +++++++++----
 src/inspector_socket.cc |  3 ++-
 2 files changed, 11 insertions(+), 5 deletions(-)

diff --git a/src/inspector_io.cc b/src/inspector_io.cc
index e0b4b6c37461..8bf33814a62a 100644
--- a/src/inspector_io.cc
+++ b/src/inspector_io.cc
@@ -17,8 +17,9 @@
 #include "v8-inspector.h"
 #include "zlib.h"
 
-#include <deque>
+#include <charconv>
 #include <cstring>
+#include <deque>
 #include <vector>
 
 namespace node {
@@ -378,12 +379,16 @@ void InspectorIoDelegate::MessageReceived(int session_id,
   if (target_session_id_str) {
     bool is_number = std::all_of(target_session_id_str->begin(),
                                  target_session_id_str->end(),
-                                 ::isdigit);
+                                 [](unsigned char c) { return ::isdigit(c); });
     if (is_number) {
-      int target_session_id = std::stoi(*target_session_id_str);
+      int target_session_id = 0;
+      const auto& s = *target_session_id_str;
+      auto [ptr, ec] =
+          std::from_chars(s.data(), s.data() + s.size(), target_session_id);
+      if (ec != std::errc{}) return;
       worker = TargetManager::WorkerForSession(target_session_id);
       if (worker) {
-        merged_session_id += target_session_id << 16;
+        merged_session_id += static_cast<unsigned int>(target_session_id) << 16;
       }
     }
   }
diff --git a/src/inspector_socket.cc b/src/inspector_socket.cc
index 52e53373c93a..28ce5e310e87 100644
--- a/src/inspector_socket.cc
+++ b/src/inspector_socket.cc
@@ -360,7 +360,8 @@ static ws_decode_result decode_frame_hybi17(const std::vector<char>& buffer,
   }
   size_t payload_length = static_cast<size_t>(payload_length64);
 
-  if (buffer.size() - kMaskingKeyWidthInBytes < payload_length)
+  if (static_cast<size_t>(buffer.end() - it) <
+      kMaskingKeyWidthInBytes + payload_length)
     return FRAME_INCOMPLETE;
 
   std::vector<char>::const_iterator masking_key = it;