Merge branch 'main' into claude/fix-http-send-payload-oob

- Rename test to test/regression/issue/23092.test.ts using real issue number
- Replace .repeat() with Buffer.alloc().toString() per test guidelines

https://claude.ai/code/session_01BAYXgJ7J3MSJqLU1dhp22M

src/bun.js/bindings/bindings.cpp

@@ -1906,12 +1906,14 @@ void WebCore__FetchHeaders__copyTo(WebCore::FetchHeaders* headers, StringPointer
 }
 void WebCore__FetchHeaders__count(WebCore::FetchHeaders* headers, uint32_t* count, uint32_t* buf_len)
 {
-    auto iter = headers->createIterator();
+    // Use lowerCaseKeys=false to match copyTo, which also uses false.
+    // This ensures the byte length computed here matches what copyTo writes.
+    // With lowerCaseKeys=true, Unicode lowercasing can change UTF-8 byte lengths
+    // (e.g. U+0130 'İ' is 2 bytes but lowercases to 'i' which is 1 byte),
+    // causing the buffer to be undersized and copyTo to write out of bounds.
+    auto iter = headers->createIterator(false);
     size_t i = 0;
     for (auto pair = iter.next(); pair; pair = iter.next()) {
-        // UTF8 byteLength is not strictly necessary here
-        // They should always be ASCII.
-        // However, we can still do this out of an abundance of caution
         i += BunString::utf8ByteLength(pair->key);
         i += BunString::utf8ByteLength(pair->value);
     }

test/regression/issue/23092.test.ts

@@ -0,0 +1,44 @@
+import { expect, test } from "bun:test";
+
+// Regression test for #23092 - panic in sendInitialRequestPayload:
+// "index out of bounds: index 4162794746, len 671"
+//
+// Root cause: WebCore__FetchHeaders__count used createIterator()
+// (lowerCaseKeys=true) while WebCore__FetchHeaders__copyTo used
+// createIterator(false). The mismatch means count computed byte
+// lengths on lowercased keys while copyTo wrote original-case keys.
+// For non-ASCII header names where Unicode lowercasing changes UTF-8
+// byte length, this caused the buffer to be undersized, and copyTo
+// would write out of bounds, corrupting adjacent StringPointer data.
+
+test("fetch with many headers does not corrupt header data", async () => {
+  using server = Bun.serve({
+    port: 0,
+    async fetch(req) {
+      const body = await req.text();
+      return new Response(`${req.headers.get("x-check") ?? "missing"}:${body.length}`, {
+        status: 200,
+      });
+    },
+  });
+
+  // Exercise the header copy path with varying header sizes
+  for (let i = 0; i < 10; i++) {
+    const headers = new Headers();
+    headers.set("X-Check", `value-${i}`);
+    // Add progressively more headers to stress the buffer
+    for (let j = 0; j < i * 5; j++) {
+      headers.set(`X-Header-${j}`, Buffer.alloc(j + 1, "x").toString());
+    }
+
+    const response = await fetch(server.url, {
+      method: "POST",
+      headers,
+      body: Buffer.alloc(671, "a").toString(),
+    });
+
+    const text = await response.text();
+    expect(text).toBe(`value-${i}:671`);
+    expect(response.status).toBe(200);
+  }
+});