fix(inworld): enforce decoded TTS audio cap

vincentkoc · vincentkoc · commit a3acea84d4f1 · 2026-06-28T16:59:34.000-07:00
diff --git a/extensions/inworld/tts.test.ts b/extensions/inworld/tts.test.ts
@@ -406,6 +406,18 @@ describe("Inworld response read bounding", () => {
     expect(audio.toString("utf8")).toBe(payload);
   });
 
+  it("fail-closed: rejects decoded audio that exceeds the shared audio cap", async () => {
+    const decodedPayload = Buffer.alloc(16 * MiB + 1, 0x61);
+    const body = JSON.stringify({
+      result: { audioContent: decodedPayload.toString("base64") },
+    });
+    queueGuardedResponse(new Response(body, { status: 200 }));
+
+    await expect(inworldTTS({ text: "test", apiKey: "test-key" })).rejects.toThrow(
+      /Inworld TTS decoded audio too large: 16777217 bytes \(limit: 16777216 bytes\)/,
+    );
+  });
+
   it("regression: a malformed NDJSON line under the cap still throws a bounded parse error", async () => {
     queueGuardedResponse(new Response("this-is-not-json", { status: 200 }));
     await expect(inworldTTS({ text: "test", apiKey: "test-key" })).rejects.toThrow(
diff --git a/extensions/inworld/tts.ts b/extensions/inworld/tts.ts
@@ -160,6 +160,7 @@ export async function inworldTTS(params: {
       })
     ).toString("utf8");
     const chunks: Buffer[] = [];
+    let decodedAudioBytes = 0;
 
     for (const line of body.split("\n")) {
       const trimmed = line.trim();
@@ -184,7 +185,15 @@ export async function inworldTTS(params: {
       }
 
       if (parsed.result?.audioContent) {
-        chunks.push(Buffer.from(parsed.result.audioContent, "base64"));
+        const chunk = Buffer.from(parsed.result.audioContent, "base64");
+        const nextDecodedAudioBytes = decodedAudioBytes + chunk.length;
+        if (nextDecodedAudioBytes > MAX_AUDIO_BYTES) {
+          throw new Error(
+            `Inworld TTS decoded audio too large: ${nextDecodedAudioBytes} bytes (limit: ${MAX_AUDIO_BYTES} bytes)`,
+          );
+        }
+        decodedAudioBytes = nextDecodedAudioBytes;
+        chunks.push(chunk);
       }
     }
 
