@overdeck/desktop 0.49.2 → 0.50.1

package/server/node_modules/msgpackr/dist/index.js

@@ -481,11 +481,7 @@
 				default: // negative int
 					if (token >= 0xe0)
 						return token - 0x100;
-					if (token === undefined) {
-						let error = new Error('Unexpected end of MessagePack data');
-						error.incomplete = true;
-						throw error;
-					}
+					if (token === undefined) throw endOfMessagePackError();
 					throw new Error('Unknown MessagePack token ' + token);
 
 			}
@@ -643,7 +639,16 @@
 		return result;
 	}
 
+	function endOfMessagePackError() {
+		let error = new Error('Unexpected end of MessagePack data');
+		error.incomplete = true;
+		return error;
+	}
+
 	function readArray(length) {
+		// every element occupies at least one byte, so a length beyond what remains in the source can never
+		// be satisfied; check before allocating so a small header can not force a large allocation
+		if (length > srcEnd - position$1) throw endOfMessagePackError();
 		let array = new Array(length);
 		for (let i = 0; i < length; i++) {
 			array[i] = read();
@@ -654,6 +659,7 @@
 	}
 
 	function readMap(length) {
+		if (length > (srcEnd - position$1) / 2) throw endOfMessagePackError(); // each entry needs at least two bytes
 		if (currentUnpackr.mapsAsObjects) {
 			let object = {};
 			for (let i = 0; i < length; i++) {
@@ -1323,7 +1329,7 @@
 						if (value.constructor === Object) writeStruct(value); // simple object
 						else if (value.constructor !== Map && !Array.isArray(value) && !extensionClasses.some(extClass => value instanceof extClass)) {
 							// allow user classes, if they don't need special handling (but do use toJSON if available)
-							writeStruct(value.toJSON ? value.toJSON() : value);
+							writeStruct(packr.useToJSON !== false && value.toJSON ? value.toJSON() : value);
 						} else pack(value);
 					} else
 						pack(value);
@@ -1711,7 +1717,7 @@
 								packArray(value);
 							} else {
 								// use this as an alternate mechanism for expressing how to serialize
-								if (value.toJSON) {
+								if (packr.useToJSON !== false && value.toJSON) {
 									const json = value.toJSON();
 									// if for some reason value.toJSON returns itself it'll loop forever
 									if (json !== value)