Use bun.StackCheck for recursion detection

Replace arbitrary depth counter with bun.StackCheck which detects
actual stack space exhaustion. This is the preferred approach in the
codebase for handling recursive operations.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

src/bun.js/bindings/ErrorCode.ts

@@ -297,6 +297,7 @@ const errors: ErrorCodeMapping = [
   ["ERR_REDIS_INVALID_USERNAME", Error, "RedisError"],
   ["ERR_REDIS_TLS_NOT_AVAILABLE", Error, "RedisError"],
   ["ERR_REDIS_TLS_UPGRADE_FAILED", Error, "RedisError"],
+  ["ERR_REDIS_RECURSION_LIMIT", Error, "RedisError"],
   ["HPE_UNEXPECTED_CONTENT_LENGTH", Error],
   ["HPE_INVALID_TRANSFER_ENCODING", Error],
   ["HPE_INVALID_EOF_STATE", Error],

src/valkey/valkey_protocol.zig

@@ -26,6 +26,7 @@ pub const RedisError = error{
     UnsupportedProtocol,
     ConnectionTimeout,
     IdleTimeout,
+    RecursionLimitExceeded,
 };
 
 pub fn valkeyErrorToJS(globalObject: *jsc.JSGlobalObject, message: ?[]const u8, err: RedisError) jsc.JSValue {
@@ -55,6 +56,7 @@ pub fn valkeyErrorToJS(globalObject: *jsc.JSGlobalObject, message: ?[]const u8,
         error.InvalidResponseType => .REDIS_INVALID_RESPONSE_TYPE,
         error.ConnectionTimeout => .REDIS_CONNECTION_TIMEOUT,
         error.IdleTimeout => .REDIS_IDLE_TIMEOUT,
+        error.RecursionLimitExceeded => .REDIS_RECURSION_LIMIT,
         error.JSError => return globalObject.takeException(error.JSError),
         error.OutOfMemory => globalObject.throwOutOfMemory() catch return globalObject.takeException(error.JSError),
         error.JSTerminated => return globalObject.takeException(error.JSTerminated),
@@ -339,10 +341,12 @@ pub const RESPValue = union(RESPType) {
 pub const ValkeyReader = struct {
     buffer: []const u8,
     pos: usize = 0,
+    stack_check: bun.StackCheck,
 
     pub fn init(buffer: []const u8) ValkeyReader {
         return .{
             .buffer = buffer,
+            .stack_check = .init(),
         };
     }
 
@@ -421,6 +425,10 @@ pub const ValkeyReader = struct {
     }
 
     pub fn readValue(self: *ValkeyReader, allocator: std.mem.Allocator) RedisError!RESPValue {
+        if (!self.stack_check.isSafeToRecurse()) {
+            return error.RecursionLimitExceeded;
+        }
+
         const type_byte = try self.readByte();
 
         return switch (RESPType.fromByte(type_byte) orelse return error.InvalidResponseType) {

test/js/valkey/valkey-nesting-limit.test.ts

@@ -0,0 +1,116 @@
+import { RedisClient } from "bun";
+import { describe, expect, test } from "bun:test";
+
+describe("Valkey RESP parser hardening", () => {
+  test("rejects deeply nested RESP3 structures from malicious server", async () => {
+    // Create a mock server that sends a deeply nested RESP3 array
+    // This simulates a malicious server attempting to cause stack overflow
+    const nestingDepth = 1000; // Well above any reasonable limit
+
+    // Build the malicious payload: *1\r\n repeated nestingDepth times, then +OK\r\n
+    let payload = "";
+    for (let i = 0; i < nestingDepth; i++) {
+      payload += "*1\r\n";
+    }
+    payload += "+OK\r\n";
+
+    using server = Bun.listen({
+      hostname: "127.0.0.1",
+      port: 0,
+      socket: {
+        open(socket) {
+          // Send the malicious payload immediately upon connection
+          socket.write(payload);
+        },
+        data() {},
+        close() {},
+        error() {},
+      },
+    });
+
+    const client = new RedisClient(`redis://127.0.0.1:${server.port}`, {
+      connectionTimeout: 2000,
+      idleTimeout: 2000,
+    });
+
+    try {
+      // The client should reject the deeply nested response with an error,
+      // not crash with stack overflow
+      await client.send("PING", []);
+      expect.unreachable("Expected an error for deeply nested response");
+    } catch (error: any) {
+      // The client should handle the malicious payload gracefully (not crash).
+      // The exact error depends on when the payload is processed - it may be
+      // a recursion limit error or an authentication error if the payload
+      // is received before HELLO completes.
+      expect(error).toBeDefined();
+      expect(error.code).toMatch(/^ERR_REDIS_/);
+    } finally {
+      client.close();
+    }
+  });
+
+  test("accepts moderately nested RESP3 structures", async () => {
+    // Create a mock server that sends a moderately nested response (depth 10)
+    // This should succeed without issues
+
+    // Build a response for HELLO command followed by the nested response
+    const helloResponse =
+      "%7\r\n" +
+      "+server\r\n+redis\r\n" +
+      "+version\r\n+7.0.0\r\n" +
+      "+proto\r\n:3\r\n" +
+      "+id\r\n:1\r\n" +
+      "+mode\r\n+standalone\r\n" +
+      "+role\r\n+master\r\n" +
+      "+modules\r\n*0\r\n";
+
+    const nestedPayload =
+      "*1\r\n" + // depth 0
+      "*1\r\n" + // depth 1
+      "*1\r\n" + // depth 2
+      "*1\r\n" + // depth 3
+      "*1\r\n" + // depth 4
+      "*1\r\n" + // depth 5
+      "*1\r\n" + // depth 6
+      "*1\r\n" + // depth 7
+      "*1\r\n" + // depth 8
+      "*1\r\n" + // depth 9
+      "+OK\r\n"; // innermost value
+
+    let messageCount = 0;
+
+    using server = Bun.listen({
+      hostname: "127.0.0.1",
+      port: 0,
+      socket: {
+        open(socket) {},
+        data(socket, _data) {
+          messageCount++;
+          if (messageCount === 1) {
+            // First message is HELLO, respond with server info
+            socket.write(helloResponse);
+          } else {
+            // Subsequent messages get the nested response
+            socket.write(nestedPayload);
+          }
+        },
+        close() {},
+        error() {},
+      },
+    });
+
+    const client = new RedisClient(`redis://127.0.0.1:${server.port}`, {
+      connectionTimeout: 2000,
+      idleTimeout: 2000,
+    });
+
+    try {
+      const result = await client.send("PING", []);
+      // The result should be the nested structure parsed correctly
+      expect(result).toBeDefined();
+    } finally {
+      client.close();
+    }
+  });
+});