@componentor/fs 3.0.13 → 3.0.15

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -777,8 +777,8 @@ var VFSEngine = class {
777
777
  tData = tAlloc;
778
778
  tInode = tAlloc;
779
779
  }
780
+ this.commitPending();
780
781
  if (flags & 1) {
781
- this.commitPending();
782
782
  this.handle.flush();
783
783
  }
784
784
  const tFlush = this.debug ? performance.now() : 0;
@@ -1428,11 +1428,18 @@ var OP = {
1428
1428
  var encoder2 = new TextEncoder();
1429
1429
  var decoder2 = new TextDecoder();
1430
1430
  function decodeRequest(buf) {
1431
+ if (buf.byteLength < 16) {
1432
+ throw new Error(`Request buffer too small: ${buf.byteLength} < 16 bytes (possible SAB race)`);
1433
+ }
1431
1434
  const view = new DataView(buf);
1432
1435
  const op = view.getUint32(0, true);
1433
1436
  const flags = view.getUint32(4, true);
1434
1437
  const pathLen = view.getUint32(8, true);
1435
1438
  const dataLen = view.getUint32(12, true);
1439
+ const expectedMin = 16 + pathLen + dataLen;
1440
+ if (buf.byteLength < expectedMin) {
1441
+ throw new Error(`Request buffer truncated: ${buf.byteLength} < ${expectedMin} bytes (op=${op}, pathLen=${pathLen}, dataLen=${dataLen})`);
1442
+ }
1436
1443
  const bytes = new Uint8Array(buf);
1437
1444
  const path = decoder2.decode(bytes.subarray(16, 16 + pathLen));
1438
1445
  const data = dataLen > 0 ? bytes.subarray(16 + pathLen, 16 + pathLen + dataLen) : null;