fix(security): prevent from stack buffer overflow in fromBigInt (CVE-2025-3194)

[ja88a]

Summary

Bug fix for CVE-2025-3194 bigint-buffer Vulnerable to Buffer Overflow via toBigIntLE() Function

Fixes the high-severity stack buffer overflow vulnerability in the native fromBigInt function (SNYK-JS-BIGINTBUFFER-3364597).

An improved version of previously submitted fix in PR #63

• Renamed BUFFER_STACK_SIZE (32) to BUFFER_STACK_WORDS (32) + BUFFER_STACK_BYTES (256) to eliminate the element-vs-byte unit ambiguity that caused the bug
• fromBigInt: Changed fits_in_stack to compare the actual allocation size (byte_width + overflow_len) against BUFFER_STACK_BYTES instead of comparing word_count * 8 against an element count
• toBigInt: Updated to use the same byte-based constant for consistency

Impact

This package is a transitive dependency of many Solana ecosystem libraries. The vulnerability is flagged as high severity and blocks security audits for downstream consumers.

Root cause

The fits_in_stack check in fromBigInt compared word_count * 8 (the BigInt's word size in bytes) against BUFFER_STACK_SIZE (32 — an element count, not a byte count) to decide whether to use a stack-allocated temporary buffer or malloc. The subsequent memset and napi_get_value_bigint_words always operated on byte_width + overflow_len bytes (the output buffer size rounded up to 8-byte alignment).

When a small BigInt was converted to a large non-64-aligned buffer (e.g. toBufferBE(3n, 257)), the check passed because the BigInt's word count was small, but memset wrote 264 bytes into a 256-byte stack buffer — a classic stack buffer overflow.

Fix

• fromBigInt: Compare the actual required allocation size (byte_width + overflow_len) against the stack buffer's capacity in bytes.
• Constant rename: BUFFER_STACK_SIZE → BUFFER_STACK_WORDS + new BUFFER_STACK_BYTES (= WORDS * sizeof(uint64_t)), eliminating the ambiguous element-vs-byte unit mismatch that caused the original bug and existed in toBigInt as well.
• toBigInt: Updated to use BUFFER_STACK_BYTES for consistency (was previously safe due to uint8_t[] declaration, but the mixed units were misleading).

Tests

8 new regression tests in the Buffer overflow regression suite:

• Small BigInt → 33-byte and 257-byte buffers (both BE and LE) — the exact code paths that triggered the overflow
• Roundtrip conversions (buffer → bigint → buffer) at those widths to verify correctness end-to-end

All 46 tests pass (node). Browser tests are skipped as they fail on unmodified master due to a pre-existing webpack/OpenSSL incompatibility with modern Node versions.