@amritk/nish-x86_64-linux 0.15.0 → 0.17.0

package/runtime/runtime-os.c

@@ -34,6 +34,7 @@
    the LEGACY symbol, for which a NULL second argument is undefined. */
 #define _XOPEN_SOURCE 700
 #include <dirent.h>
+#include <errno.h>
 #include <limits.h>
 #include <fcntl.h>
 #include <stdint.h>
@@ -52,6 +53,19 @@ extern char **environ;
 
 #include "nish.h"
 
+/* Darwin's <fcntl.h> declares `O_NOFOLLOW` only at its full C level, and the
+   strict level the two macros above select is the one that binds the right
+   `realpath`, so the flag is spelled here with Darwin's own value
+   (<sys/fcntl.h>: 0x00000100). Linux and WASI declare it at POSIX 2008. */
+#if defined(__APPLE__) && !defined(O_NOFOLLOW)
+#define O_NOFOLLOW 0x00000100
+#endif
+/* `O_CLOEXEC` is POSIX 2008 and declared at that level everywhere; the
+   fallback is for an older Darwin SDK, with its value from the same header. */
+#if defined(__APPLE__) && !defined(O_CLOEXEC)
+#define O_CLOEXEC 0x01000000
+#endif
+
 /* The same spelling runtime.c uses for its own cold paths: a function that
    reports and exits is never on a path worth optimising for. */
 #define NISH_COLD __attribute__((noreturn, cold, noinline))
@@ -63,6 +77,12 @@ static NISH_COLD void nish_io_fail(const char *what, const nish_str *path) {
   _exit(1);
 }
 
+/* The longest string or array a read hands back: 2^31 - 1, the same limit
+   runtime.c's `NISH_ARRAY_MAX` puts on a push. Under --number-mode i32
+   `length` is an `i32`, so one byte more reads back negative and bounds-check
+   elimination trusts it (docs/security/runtime.md, RT-1). */
+#define NISH_LENGTH_MAX 2147483647
+
 /* `readFileSyncOrNull(path)`: null rather than a message, so a program can
    turn a missing file into its own diagnostic and carry on.
  *
@@ -82,20 +102,38 @@ static NISH_COLD void nish_io_fail(const char *what, const nish_str *path) {
  * narrower guard would have made it `null` here and split the two compilers
  * again for the entry a command line can name. `fstat` on the descriptor
  * rather than `stat` on the path, so the answer is about the file that was
- * opened and not about whatever the name means a moment later. */
+ * opened and not about whatever the name means a moment later.
+ *
+ * The descriptor is `O_CLOEXEC` (docs/security/runtime.md, RT-12): a child
+ * that a `scope()` task spawns while another task reads would otherwise
+ * inherit it. A `pread` that a signal interrupts before it moves a byte is
+ * retried rather than taken for the end of the file (RT-13). A local disk
+ * never interrupts one, but FUSE and NFS can, and stopping there would hand
+ * back the bytes so far as the whole file. */
 nish_str *nish_read_file_or_null(const nish_str *path) {
-  int fd = open(path->data, O_RDONLY);
+  int fd = open(nish_cpath(path), O_RDONLY | O_CLOEXEC);
   if (fd < 0) return 0;
   struct stat st;
   off_t len = fstat(fd, &st) == 0 && !S_ISDIR(st.st_mode) ? lseek(fd, 0, SEEK_END) : -1;
-  if (len < 0) {
+  /* A file longer than a length can say is refused before anything is
+     allocated, as an unreadable one is: null here, null from
+     `readFileBytesSync`, and `cannot read` from `readFileSync`. The bytes read
+     below are never more than `len`, so a file that grows meanwhile cannot
+     pass the limit either. */
+  if (len < 0 || len > NISH_LENGTH_MAX) {
     close(fd);
     return 0;
   }
   nish_str *s = nish_alloc_struct(8 + len + 1);
   uint64_t got = 0;
   ssize_t n;
-  while ((n = pread(fd, s->data + got, len - got, got)) > 0) got += n;
+  while ((n = pread(fd, s->data + got, len - got, got)) != 0) {
+    if (n > 0) {
+      got += n;
+    } else if (errno != EINTR) {
+      break;
+    }
+  }
   close(fd);
   s->len = got;
   s->data[got] = 0;
@@ -123,13 +161,26 @@ nish_str *nish_read_file(const nish_str *path) {
   return s;
 }
 
+/* `O_NOFOLLOW` (docs/security/runtime.md, RT-4): a symbolic link as the last
+   component of the path is refused, as an unwritable file is, rather than
+   followed to whatever file it names. `nish file.ts` writes `file.ll` beside
+   its source, so a link planted at that name in a checkout would otherwise
+   truncate any file the user can write. A link among the directories on the
+   way is still followed.
+
+   `O_CLOEXEC` for the reason the read has it (RT-12), and `EINTR` is retried
+   as the read retries it (RT-13): a write cut short is finished, and one that
+   fails is `cannot write`, never a silently short file. */
 static void nish_put_file(const nish_str *path, const nish_str *data, int flags) {
-  int fd = open(path->data, O_WRONLY | O_CREAT | flags, 0644);
+  int fd = open(nish_cpath(path), O_WRONLY | O_CREAT | O_NOFOLLOW | O_CLOEXEC | flags, 0644);
   if (fd < 0) nish_io_fail("write ", path);
   for (uint64_t done = 0; done < data->len;) {
     ssize_t n = write(fd, data->data + done, data->len - done);
-    if (n <= 0) nish_io_fail("write ", path);
-    done += n;
+    if (n > 0) {
+      done += n;
+    } else if (n == 0 || errno != EINTR) {
+      nish_io_fail("write ", path);
+    }
   }
   close(fd);
 }
@@ -149,14 +200,14 @@ void nish_append_file(const nish_str *path, const nish_str *data) { nish_put_fil
    answer to that question. */
 _Bool nish_is_dir(const nish_str *path) {
   struct stat st;
-  return stat(path->data, &st) == 0 && S_ISDIR(st.st_mode);
+  return stat(nish_cpath(path), &st) == 0 && S_ISDIR(st.st_mode);
 }
 
 /* One directory, not recursive. The retry is the `stat` above rather than
    `errno == EEXIST` so that a plain file at the path answers false, which is
    what the promise "a directory is there afterwards" means. */
 _Bool nish_mkdir(const nish_str *path) {
-  return mkdir(path->data, 0777) == 0 || nish_is_dir(path);
+  return mkdir(nish_cpath(path), 0777) == 0 || nish_is_dir(path);
 }
 
 /* `posix_spawnp` is one libc call where fork/execvp/waitpid would be three,
@@ -168,7 +219,7 @@ _Bool nish_mkdir(const nish_str *path) {
    two arguments answered differently, so the argv vector, the wait and the
    signal convention are written once; it is `static`, so a program that spawns
    nothing still loses all three to `--gc-sections`. */
-static int32_t nish_spawn_impl(const nish_array *argv, const char *out, const char *err) {
+static int32_t nish_spawn_impl(const nish_array *argv, const nish_str *out, const nish_str *err) {
 #ifdef __wasi__
   (void)argv;
   (void)out;
@@ -181,23 +232,30 @@ static int32_t nish_spawn_impl(const nish_array *argv, const char *out, const ch
      path out of here has anything to free. */
   char **v = nish_alloc_struct((argv->len + 1) * sizeof *v);
   uint64_t i = 0;
-  for (; i < argv->len; i++) v[i] = s[i]->data;
+  /* An argument holding a NUL is refused rather than cut short at it, which
+     would run a different command line from the one the program built: it is
+     the one whose C string is not its own bytes. */
+  for (; i < argv->len; i++) {
+    v[i] = (char *)nish_cpath(s[i]);
+    if (v[i] != s[i]->data) return -1;
+  }
   v[i] = 0;
+  /* One list of file actions whether or not a stream is redirected: an empty
+     list is the same spawn as none, and one path through is less code than
+     creating the list only when a stream needs it. */
   posix_spawn_file_actions_t fa;
-  posix_spawn_file_actions_t *fap = 0;
-  if (out || err) {
-    if (posix_spawn_file_actions_init(&fa)) return -1;
-    fap = &fa;
+  if (posix_spawn_file_actions_init(&fa)) return -1;
+  const nish_str *to[2] = { out, err };
+  for (int k = 0; k < 2; k++) {
     /* The child opens the file, not this process: a redirect that this process
        performed would have to be undone afterwards, and a failed open would
        leave its own stdout pointing at the file. */
-    if (out) posix_spawn_file_actions_addopen(fap, 1, out, O_WRONLY | O_CREAT | O_TRUNC, 0644);
-    if (err) posix_spawn_file_actions_addopen(fap, 2, err, O_WRONLY | O_CREAT | O_TRUNC, 0644);
+    if (to[k]) posix_spawn_file_actions_addopen(&fa, k + 1, nish_cpath(to[k]), O_WRONLY | O_CREAT | O_TRUNC | O_NOFOLLOW, 0644);
   }
   pid_t pid;
   int status;
-  int failed = posix_spawnp(&pid, v[0], fap, 0, v, environ);
-  if (fap) posix_spawn_file_actions_destroy(fap);
+  int failed = posix_spawnp(&pid, v[0], &fa, 0, v, environ);
+  posix_spawn_file_actions_destroy(&fa);
   if (failed) return -1;
   if (waitpid(pid, &status, 0) < 0) return -1;
   return WIFSIGNALED(status) ? 128 + WTERMSIG(status) : WEXITSTATUS(status);
@@ -210,14 +268,15 @@ int32_t nish_spawn(const nish_array *argv) { return nish_spawn_impl(argv, 0, 0);
    to a file, which is what comparing a program's output against a golden needs
    — `nish_spawn` answers a status and the output is gone. An **empty** path
    leaves that stream inherited, so one call can capture stdout and let stderr
-   through to the terminal. Each file is created or truncated at 0644, as
-   `writeFileSync` does.
+   through to the terminal. Each file is created or truncated at 0644 and a
+   symbolic link at its name is refused, as `writeFileSync` does; the child
+   then fails to start, and the answer is -1.
 
    Two streams must not name one path: each would be opened separately, with
    its own offset, and the two would overwrite each other rather than
    interleave. Capturing them apart and concatenating is the way to merge. */
 int32_t nish_spawn_to(const nish_array *argv, const nish_str *out, const nish_str *err) {
-  return nish_spawn_impl(argv, out->len ? out->data : 0, err->len ? err->data : 0);
+  return nish_spawn_impl(argv, out->len ? out : 0, err->len ? err : 0);
 }
 
 /* `readdirSync(path)`: the listing a driver needs to discover its own inputs.
@@ -240,7 +299,7 @@ nish_array *nish_readdir(const nish_str *path) {
   (void)path;
   return 0;
 #else
-  DIR *d = opendir(path->data);
+  DIR *d = opendir(nish_cpath(path));
   if (!d) return 0;
   nish_array *a = nish_alloc_struct(sizeof *a);
   *a = (nish_array){ 0, 0, 0 };
@@ -252,15 +311,30 @@ nish_array *nish_readdir(const nish_str *path) {
     ((nish_str **)a->data)[a->len++] = nish_str_new(n, strlen(n));
   }
   closedir(d);
-  /* Insertion sort over pointers: a directory is short, and `qsort` would cost
-     a comparator symbol and its unwind entry for a call that is never hot. */
+  /* Heapsort over pointers, in place. It was an insertion sort, on the theory
+     that a directory is short, but whoever fills the directory decides that:
+     100,000 names took 2.5 billion compares and 12.5 s, where this takes 3.0
+     million and 0.07 s (docs/security/runtime.md, RT-5). It needs no scratch
+     memory, and unlike `qsort` costs no comparator symbol or unwind entry. */
   nish_str **v = (nish_str **)a->data;
-  for (uint64_t i = 1; i < a->len; i++) {
-    nish_str *s = v[i];
-    uint64_t j = i;
-    while (j && strcmp(v[j - 1]->data, s->data) > 0) {
-      v[j] = v[j - 1];
-      j--;
+  /* Each pass sifts one name down the max-heap `v[0, end)`: first every
+     parent from the middle up, which builds the heap, then the name the
+     largest is swapped out for, which shrinks the heap by one. */
+  uint64_t i = a->len / 2, end = a->len;
+  while (end > 1) {
+    nish_str *s;
+    if (i) {
+      s = v[--i];
+    } else {
+      s = v[--end];
+      v[end] = v[0];
+    }
+    uint64_t j = i, c;
+    while ((c = 2 * j + 1) < end) {
+      if (c + 1 < end && strcmp(v[c]->data, v[c + 1]->data) < 0) c++;
+      if (strcmp(s->data, v[c]->data) >= 0) break;
+      v[j] = v[c];
+      j = c;
     }
     v[j] = s;
   }
@@ -279,6 +353,10 @@ int64_t nish_monotonic_nanos(void) {
   return (int64_t)ts.tv_sec * 1000000000 + ts.tv_nsec;
 }
 
+/* A C string copied into the arena, or NULL for NULL: the shape of every
+   answer libc hands back by pointer, `getenv`'s here and `realpath`'s below. */
+static nish_str *nish_str_or_null(const char *v) { return v ? nish_str_new(v, strlen(v)) : 0; }
+
 /* ---- The environment (WP19 R1): `getenv(name)`, the one environment read the
    language has. A driver needs it to honour `CC` the way `scripts/build.sh`
    does before it spawns that script, which is the whole reason it exists.
@@ -290,13 +368,7 @@ int64_t nish_monotonic_nanos(void) {
    string with the lifetime every other one has. NULL for an unset variable,
    which is the language's `string | null`. Contract: nish.h. */
 nish_str *nish_getenv(const nish_str *name) {
-  const char *v = getenv(name->data);
-  if (!v) return 0;
-  uint64_t len = strlen(v);
-  nish_str *s = nish_alloc_struct(8 + len + 1);
-  s->len = len;
-  memcpy(s->data, v, len + 1);
-  return s;
+  return nish_str_or_null(getenv(nish_cpath(name)));
 }
 
 /* ---- Symlinks (WP19 §5a item 4): `realpathSync(path)`, the one path
@@ -318,15 +390,25 @@ nish_str *nish_getenv(const nish_str *name) {
    and the stack buffer is gone at the return. NULL when the path does not
    resolve -- a path that does not exist included -- which is the language's
    `string | null` rather than an error, because the caller is asking whether
-   it resolves. Contract: nish.h. */
+   it resolves. Contract: nish.h.
+
+   A wasi-libc from before 2024, which is what Ubuntu and Debian package,
+   neither declares nor defines `realpath`, so there every path is one that
+   does not resolve and the answer is NULL. WebAssembly/wasi-libc#463 declared
+   it and #473 defined it a month later, with no wasi-sdk release between, and
+   #463 also gave `<dirent.h>` its `DT_SOCK`, which the old headers spell only
+   for upstream musl. So a missing `DT_SOCK` is the test: it names the libc
+   without the function, and wasi-sdk 22 and later keep the real `realpath`.
+   It is a preprocessor test rather than a declaration of our own because the
+   old libc.a has no definition to link. */
 nish_str *nish_realpath(const nish_str *path) {
+#if defined(__wasi__) && !defined(DT_SOCK)
+  (void)path;
+  return 0;
+#else
   char buf[PATH_MAX];
-  if (!realpath(path->data, buf)) return 0;
-  uint64_t len = strlen(buf);
-  nish_str *s = nish_alloc_struct(8 + len + 1);
-  s->len = len;
-  memcpy(s->data, buf, len + 1);
-  return s;
+  return nish_str_or_null(realpath(nish_cpath(path), buf));
+#endif
 }
 
 /* ---- What machine this is (WP14 §7a): `process.platform` and `process.arch`,

package/runtime/runtime-parallel.c

@@ -109,7 +109,11 @@ void nish_parallel_range(nish_par_body body, void *ctx, int64_t len, int64_t gra
   if (grain < 1) grain = 1;
   /* Never more threads than there is work for at the requested granularity,
    * and never more than the machine has. */
-  int64_t chunks = (len + grain - 1) / grain;
+  /* Rounded up without `len + grain - 1`, which overflows -- undefined
+     behaviour, and in practice a negative count that ran the whole range on
+     one thread -- once `len` is within `grain` of 2^63
+     (docs/security/runtime.md, RT-8). */
+  int64_t chunks = len / grain + (len % grain != 0);
   int64_t n = nish_cpu_count();
   if (n > NISH_PAR_MAX) n = NISH_PAR_MAX;
   if (chunks < n) n = chunks;

package/runtime/runtime-wasm.c

@@ -40,7 +40,14 @@ _Static_assert(offsetof(struct nish_arena, chunks) == 24, "arena layout is ABI")
 extern unsigned char __heap_base;
 #define NISH_PAGE ((uint64_t)65536)
 
-/* Slow path of the inlined allocator (`size` is already 8-byte rounded). */
+/* Slow path of the inlined allocator (`size` is already 8-byte rounded).
+ *
+ * `need` has to fit the 32-bit address space, and is checked before anything
+ * is grown (docs/security/runtime.md, RT-7). Without that, an `off + size` that
+ * wrapped 2^64 looked small and moved the offset backwards, and a page count
+ * past 2^32 truncated to the `uintptr_t` `memory.grow` takes: a request of
+ * 2^48 bytes grew nothing, claimed 2^48 bytes of capacity, and the next block
+ * landed at `buf + off` reduced mod 2^32, on top of live data. */
 void *nish_arena_grow(uint64_t size) {
   if (!nish_arena.buf) {
     uintptr_t base = ((uintptr_t)&__heap_base + 7) & ~(uintptr_t)7;
@@ -48,6 +55,7 @@ void *nish_arena_grow(uint64_t size) {
     nish_arena.cap = (uint64_t)__builtin_wasm_memory_size(0) * NISH_PAGE - base;
   }
   uint64_t need = nish_arena.off + size;
+  if (need < size || need > (uintptr_t)-1 - (uintptr_t)nish_arena.buf) __builtin_trap();
   if (need > nish_arena.cap) {
     uint64_t pages = (need - nish_arena.cap + NISH_PAGE - 1) / NISH_PAGE;
     if (__builtin_wasm_memory_grow(0, (uintptr_t)pages) == (uintptr_t)-1) __builtin_trap();
@@ -58,9 +66,12 @@ void *nish_arena_grow(uint64_t size) {
   return p;
 }
 
+/* `size <= cap - off` rather than `off + size <= cap`, which a size near 2^64
+   wraps into a yes; a size that rounding wraps to 0 is trapped the same way. */
 void *nish_alloc_struct(uint64_t size) {
+  if (size > (uint64_t)-8) __builtin_trap();
   size = (size + 7) & ~(uint64_t)7;
-  if (nish_arena.buf && nish_arena.off + size <= nish_arena.cap) {
+  if (nish_arena.buf && size <= nish_arena.cap - nish_arena.off) {
     void *p = nish_arena.buf + nish_arena.off;
     nish_arena.off += size;
     return p;
@@ -77,7 +88,15 @@ void nish_arena_release(uint64_t mark) { nish_arena.off = mark ? mark - (uintptr
 /* ---- Arrays: %struct.nish_array = type { i64, i64, i8* } */
 typedef struct nish_array { uint64_t len; uint64_t cap; char *data; } nish_array;
 
+/* The length limit runtime.c's `nish_array_grow` and `nish_alloc_array` keep:
+   2^31 - 1 elements, so an i32-mode `length` is never negative. Past it the
+   wasm runtime traps, as it does for every other failure. */
+#define NISH_ARRAY_MAX 2147483647u
+
 nish_array *nish_alloc_array(uint64_t elem_size, uint64_t len) {
+  /* With `len` in range, `len * elem_size` cannot wrap for any element
+     smaller than 8 GiB, and a product past 4 GiB traps in the grow. */
+  if (len > NISH_ARRAY_MAX) __builtin_trap();
   nish_array *a = (nish_array *)nish_alloc_struct(sizeof *a);
   a->len = a->cap = len;
   a->data = (char *)nish_alloc_struct(len * elem_size);
@@ -86,6 +105,10 @@ nish_array *nish_alloc_array(uint64_t elem_size, uint64_t len) {
 
 void nish_array_grow(nish_array *a, uint64_t elem_size) {
   uint64_t cap = a->cap ? a->cap * 2 : 4;
+  if (cap > NISH_ARRAY_MAX) {
+    if (a->len >= NISH_ARRAY_MAX) __builtin_trap();
+    cap = NISH_ARRAY_MAX;
+  }
   char *data = (char *)nish_alloc_struct(cap * elem_size);
   if (a->len) __builtin_memcpy(data, a->data, (uintptr_t)(a->len * elem_size)); /* memory.copy (-mbulk-memory) */
   a->data = data;
@@ -96,6 +119,7 @@ void nish_array_grow(nish_array *a, uint64_t elem_size) {
 void nish_panic_index(uint64_t idx, uint64_t len) { (void)idx; (void)len; __builtin_trap(); }
 void nish_panic_slice(int64_t s, int64_t e, int64_t len) { (void)s; (void)e; (void)len; __builtin_trap(); }
 void nish_panic_div(_Bool by_zero) { (void)by_zero; __builtin_trap(); }
+void nish_panic_overflow(uint32_t op) { (void)op; __builtin_trap(); }
 void nish_exit(int32_t code) { (void)code; __builtin_trap(); }
 /* A panic's message (`panic`, `expect`, a failed range entry) has no stderr to
  * go to here; the `nish_exit` that follows it is the trap. An exported function

package/runtime/runtime.c

@@ -79,11 +79,21 @@ _Static_assert(offsetof(struct nish_arena, off) == 8, "the inlined allocator bum
 _Static_assert(offsetof(struct nish_arena, cap) == 16, "the inlined allocator reads field 2");
 _Static_assert(offsetof(struct nish_arena, chunks) == 24, "arena layout is ABI");
 
+/* `fputs` rather than one `write`: libc's own loop finishes a short write,
+   which a bare `write` would cut off (docs/security/runtime.md, RT-11), and
+   stderr is unbuffered, so the message leaves before `_exit`. A C host that
+   gives stderr a buffer of its own would lose it here. */
 static NISH_COLD void nish_die(const char *msg) {
-  (void)!write(2, msg, strlen(msg));
+  fputs(msg, stderr);
   _exit(1);
 }
-#define nish_oom() nish_die("nish: out of memory\n")
+/* A function rather than a macro around `nish_die`: seven call sites each
+   loading the message's address cost more than one more symbol does. */
+static NISH_COLD void nish_oom(void) { nish_die("nish: out of memory\n"); }
+
+/* The most elements an array and the most bytes a string may hold: see
+   `nish_array_grow` and `nish_str_concat`. */
+#define NISH_ARRAY_MAX 2147483647u
 
 /* Slow path (size 8-byte rounded): push a chunk (>= 64 KB), bump from it. */
 void *nish_arena_grow(uint64_t size) {
@@ -196,12 +206,19 @@ nish_str *nish_str_new(const char *bytes, uint64_t len) {
   return s;
 }
 
+/* A string never passes 2^31 - 1 bytes, for the reason an array never passes
+   that many elements (`NISH_ARRAY_MAX`, below): under --number-mode i32 a
+   longer one's `length` reads back negative and bounds-check elimination
+   trusts it (docs/security/runtime.md, RT-2). `a + b` past it fails as an
+   allocation does. */
 nish_str *nish_str_concat(const nish_str *a, const nish_str *b) {
-  nish_str *s = nish_alloc_struct(8 + a->len + b->len + 1);
-  s->len = a->len + b->len;
+  uint64_t len = a->len + b->len;
+  if (len > NISH_ARRAY_MAX) nish_oom();
+  nish_str *s = nish_alloc_struct(8 + len + 1);
+  s->len = len;
   memcpy(s->data, a->data, a->len);
   memcpy(s->data + a->len, b->data, b->len);
-  s->data[s->len] = 0;
+  s->data[len] = 0;
   return s;
 }
 
@@ -249,9 +266,22 @@ int64_t nish_str_index_of(const nish_str *s, const nish_str *sub) {
 }
 
 /* `console.log` / `console.error` / `write` / `writeError` and the message of
-   `panic`: fd 1 or 2, with or without the trailing newline. */
+   `panic`: fd 1 or 2, with or without the trailing newline.
+
+   A pipe or a socket can take part of a long string and answer the count it
+   took: a signal that lands mid-write ends the call early, and a full pipe
+   does the same. So the bytes are written until all of them are out, or until
+   a write fails (docs/security/runtime.md, RT-11). A failure still ends the
+   output, `EAGAIN` on a non-blocking stdout included, since spinning on it
+   would burn a core. `EINTR` is not retried here: it needs a handler
+   installed without `SA_RESTART`, and the only one this runtime installs
+   (runtime-host.c) has it, so an interrupted write either restarts in the
+   kernel or comes back short. The newline needs no loop: one byte is never
+   written in part. */
 void nish_write(const nish_str *s, int32_t fd, _Bool newline) {
-  (void)!write(fd, s->data, s->len);
+  uint64_t done = 0;
+  ssize_t k;
+  while (done < s->len && (k = write(fd, s->data + done, s->len - done)) > 0) done += k;
   if (newline) (void)!write(fd, "\n", 1);
 }
 /* console.log(s) */
@@ -1106,8 +1136,12 @@ double nish_random(void) {
 /* ---- Arrays: %struct.nish_array = type { i64, i64, i8* }, cold paths */
 typedef struct nish_array { uint64_t len; uint64_t cap; char *data; } nish_array;
 
-/* Host entry (WP8): `len` uninitialised elements, len == cap */
+/* Host entry (WP8): `len` uninitialised elements, len == cap. A `len` past
+   `NISH_ARRAY_MAX` fails as an allocation does, which also keeps
+   `len * elem_size` from wrapping into a short block behind a long header
+   (docs/security/runtime.md, RT-7). */
 nish_array *nish_alloc_array(uint64_t elem_size, uint64_t len) {
+  if (len > NISH_ARRAY_MAX) nish_oom();
   nish_array *a = nish_alloc_struct(sizeof *a);
   *a = (nish_array){ len, len, nish_alloc_struct(len * elem_size) };
   return a;
@@ -1160,15 +1194,46 @@ double nish_parse_number(const nish_str *s, int32_t mode) {
  * `sizeof` one element, which for a record element type (WP15 section 2a) is
  * the whole struct, so this relocates the elements themselves rather than a
  * block of pointers to them. Compiled code may therefore hold no pointer into
- * `data` across a push, and the checker refuses the programs that would. */
-void nish_array_grow(nish_array *a, uint64_t elem_size) {
+ * `data` across a push, and the checker refuses the programs that would.
+ *
+ * A push never takes an array past 2^31 - 1 elements (docs/security/codegen.md,
+ * K1-6). Under --number-mode i32 `length` is an `i32`, and one element more
+ * read back as a negative or a short length everywhere, a hash or a tag
+ * compare included. This file cannot tell which mode compiled its caller, so
+ * the limit holds in both, and the push past it fails as an allocation does,
+ * through `nish_oom`. `new Array(n)` checks its own `n` in the IR.
+ *
+ * `noinline`: under LTO the grown body was inlined into every push site, and
+ * the extra compare moved register allocation in the hot loops around them
+ * (+0.2% to +2% instructions over bench/instructions.json's map rows). Out of
+ * line, every one of those rows runs fewer instructions than it did before, and
+ * the call costs nothing on a path that runs once per doubling. */
+__attribute__((noinline)) void nish_array_grow(nish_array *a, uint64_t elem_size) {
   uint64_t cap = a->cap ? a->cap * 2 : 4;
+  if (cap > NISH_ARRAY_MAX) {
+    if (a->len >= NISH_ARRAY_MAX) nish_oom();
+    cap = NISH_ARRAY_MAX;
+  }
   char *data = nish_alloc_struct(cap * elem_size);
   if (a->len) memcpy(data, a->data, a->len * elem_size);
   a->data = data;
   a->cap = cap;
 }
 
+/* `secureZero(bytes)` (#385): every byte of the array set to zero, in stores
+ * no optimisation may remove. A `memset` here would be a dead store wherever
+ * the buffer's life ends straight after the call -- a key in a frame that
+ * returns, a block that is freed -- and links use `-flto`, which inlines this
+ * body into that caller and lets dead-store elimination see it. Each store goes
+ * through a `volatile` pointer, so each is behaviour the C standard keeps
+ * whatever the optimiser can see, and `noinline` keeps the call itself in the
+ * binary for a reader of the disassembly. A byte at a time, because a secret
+ * is a key or a scalar of tens of bytes, not a buffer worth a vector loop. */
+__attribute__((noinline)) void nish_wipe(nish_array *bytes) {
+  volatile char *p = bytes->data;
+  for (uint64_t i = 0; i < bytes->len; i++) p[i] = 0;
+}
+
 void nish_panic_index(uint64_t idx, uint64_t len) {
   dprintf(2, "index out of range: %" PRIu64 " >= %" PRIu64 "\n", idx, len);
   _exit(1);
@@ -1187,7 +1252,14 @@ void nish_panic_slice(int64_t start, int64_t end, int64_t len) {
   _exit(1);
 }
 
-/* ---- Checked division (Rust semantics): the failed-check path */
-void nish_panic_div(_Bool by_zero) {
-  nish_die(by_zero ? "attempt to divide by zero\n" : "attempt to divide with overflow\n");
-}
+/* ---- Checked arithmetic (Rust semantics): the failed-check paths. One table
+   for both panics, because each message is "attempt to <what>" and the two
+   functions then share everything but the index. `nish_panic_overflow`'s `op`
+   is the operator whose `llvm.s*.with.overflow` flagged: 0 add, 1 subtract,
+   2 multiply, 3 negate, the order `src/emit-ops.ts` numbers them in. */
+static const char *const nish_arith_panics[6] = {
+  "attempt to add with overflow\n",      "attempt to subtract with overflow\n",
+  "attempt to multiply with overflow\n", "attempt to negate with overflow\n",
+  "attempt to divide with overflow\n",   "attempt to divide by zero\n"};
+void nish_panic_overflow(uint32_t op) { nish_die(nish_arith_panics[op]); }
+void nish_panic_div(_Bool by_zero) { nish_panic_overflow(4 + by_zero); }