@overdeck/desktop 0.49.2 → 0.50.0

package/server/node_modules/msgpackr/dist/node.cjs

@@ -486,11 +486,7 @@ function read() {
 			default: // negative int
 				if (token >= 0xe0)
 					return token - 0x100;
-				if (token === undefined) {
-					let error = new Error('Unexpected end of MessagePack data');
-					error.incomplete = true;
-					throw error;
-				}
+				if (token === undefined) throw endOfMessagePackError();
 				throw new Error('Unknown MessagePack token ' + token);
 
 		}
@@ -688,7 +684,16 @@ function readStringJS(length) {
 	return result;
 }
 
+function endOfMessagePackError() {
+	let error = new Error('Unexpected end of MessagePack data');
+	error.incomplete = true;
+	return error;
+}
+
 function readArray(length) {
+	// every element occupies at least one byte, so a length beyond what remains in the source can never
+	// be satisfied; check before allocating so a small header can not force a large allocation
+	if (length > srcEnd - position$1) throw endOfMessagePackError();
 	let array = new Array(length);
 	for (let i = 0; i < length; i++) {
 		array[i] = read();
@@ -699,6 +704,7 @@ function readArray(length) {
 }
 
 function readMap(length) {
+	if (length > (srcEnd - position$1) / 2) throw endOfMessagePackError(); // each entry needs at least two bytes
 	if (currentUnpackr.mapsAsObjects) {
 		let object = {};
 		for (let i = 0; i < length; i++) {