From 11dc64d878c4c4e6fdf9ae24b951196610daa651 Mon Sep 17 00:00:00 2001
From: "Kamat, Trivikram" <16024985+trivikr@users.noreply.github.com>
Date: Wed, 13 May 2026 20:52:53 -0700
Subject: [PATCH] stream: validate broadcast writer writev chunks

Validate BroadcastWriter writev() and writevSync() inputs before
converting chunks so non-array values throw ERR_INVALID_ARG_TYPE.

Fixes: https://github.com/nodejs/node/issues/63299

Signed-off-by: Kamat, Trivikram <16024985+trivikr@users.noreply.github.com>
Assisted-by: openai:gpt-5.5
---
 lib/internal/streams/iter/broadcast.js       |  6 ++++++
 test/parallel/test-stream-iter-validation.js | 10 ++++++++++
 2 files changed, 16 insertions(+)

diff --git a/lib/internal/streams/iter/broadcast.js b/lib/internal/streams/iter/broadcast.js
index 769f93b5404c30..a5b00c9ba9a225 100644
--- a/lib/internal/streams/iter/broadcast.js
+++ b/lib/internal/streams/iter/broadcast.js
@@ -462,6 +462,9 @@ class BroadcastWriter {
   }
 
   writev(chunks, options) {
+    if (!ArrayIsArray(chunks)) {
+      throw new ERR_INVALID_ARG_TYPE('chunks', 'Array', chunks);
+    }
     // Fast path: no signal, writer open, buffer has space
     if (this.#canUseWriteFastPath(options)) {
       const converted = convertChunks(chunks);
@@ -522,6 +525,9 @@ class BroadcastWriter {
   }
 
   writevSync(chunks) {
+    if (!ArrayIsArray(chunks)) {
+      throw new ERR_INVALID_ARG_TYPE('chunks', 'Array', chunks);
+    }
     if (this.#isClosedOrAborted()) return false;
     if (!this.#broadcast[kCanWrite]()) return false;
     const converted = convertChunks(chunks);
diff --git a/test/parallel/test-stream-iter-validation.js b/test/parallel/test-stream-iter-validation.js
index d58eca4e63ac3b..19cde169d6f496 100644
--- a/test/parallel/test-stream-iter-validation.js
+++ b/test/parallel/test-stream-iter-validation.js
@@ -147,6 +147,16 @@ assert.throws(() => broadcast({ highWaterMark: Number.MAX_SAFE_INTEGER + 1 }),
 assert.throws(() => broadcast({ signal: {} }), { code: 'ERR_INVALID_ARG_TYPE' });
 assert.throws(() => broadcast({ backpressure: 'bad' }), { code: 'ERR_INVALID_ARG_VALUE' });
 
+// BroadcastWriter.writev requires array
+{
+  const { writer } = broadcast();
+  assert.throws(() => writer.writev('bad'), { code: 'ERR_INVALID_ARG_TYPE' });
+  assert.throws(() => writer.writev(42), { code: 'ERR_INVALID_ARG_TYPE' });
+  assert.throws(() => writer.writevSync('bad'), { code: 'ERR_INVALID_ARG_TYPE' });
+  assert.throws(() => writer.writevSync(42), { code: 'ERR_INVALID_ARG_TYPE' });
+  writer.endSync();
+}
+
 // Broadcast.from rejects non-iterable input
 assert.throws(() => Broadcast.from(42), { code: 'ERR_INVALID_ARG_TYPE' });
 assert.throws(() => Broadcast.from('bad'), { code: 'ERR_INVALID_ARG_TYPE' });