Bedrock event-stream framing buffers without bound when a frame prelude declares an oversized length #44630

packages/llm/src/protocols/bedrock-event-stream.ts reads total_length from the 4-byte frame prelude and breaks out of the decode loop until that many bytes have arrived. total_length is a 32-bit field, so a malformed or truncated response can declare up to 4 GiB. Nothing bounds the wait: appendChunk keeps appending, and because the buffer is only compacted once a frame completes, it re-copies the whole accumulated window on every network chunk.

Cost is quadratic in bytes received. Feeding bytes after a prelude declaring 0xFFFFFFFF, in 16 KiB chunks:

AWS documents a 16 MiB maximum event-stream message; @smithy/eventstream-codec does not enforce it, and neither do we. The stream also surfaces no useful error — it ends with the generic Provider stream ended without a terminal finish event after buffering everything.

Reachable from any configured Bedrock-compatible baseURL (gateway, proxy, self-hosted relay) that returns a malformed body.

Expected: reject a frame whose declared length exceeds the protocol maximum instead of buffering toward a frame that can never complete.

Happy to send a PR — the check is one comparison before the existing length gate.