amqplib 2.3.0 → 2.3.1

package/CHANGELOG.md

@@ -1,5 +1,8 @@
 # Change log for amqplib
 
+## v2.3.1
+- Throw a clear `RangeError` from `publish` when an encoded headers or `arguments` table exceeds the 64 KiB encoding buffer. Previously the outcome depended on where the boundary fell: a string or Buffer value crossing the end of the buffer was silently truncated, producing a frame whose table length prefix did not match its contents, which RabbitMQ rejected by closing the connection with a 541 `INTERNAL_ERROR` after `publish` had returned; at other positions a bare `offset is out of range` error escaped from `publish` instead (fixes #867)
+
 ## v2.3.0
 - Reject a `connection.tune` whose `frameMax` is below the protocol minimum of 4096 (the spec allows 0 or at least frame-min-size). Previously such a value was accepted, and the first publish whose encoded frames total 2048 bytes or more entered a loop in `sendContent` that never advanced, exhausting memory. `sendContent` now also throws if `frameMax` leaves no room for a body frame (GHSA-37f9-7m79-6866, reported by Rizwan Bedekar ([@r-bedekar](https://github.com/r-bedekar)); fix based in part on their patch and tests)
 - Add a `maxFrameSize` connection option, also settable as a URL query parameter, bounding the payload size of frames accepted from the server. The default is 64 MiB, or the negotiated `frameMax` if that is larger, so raising `frameMax` needs no second option; `0` disables the limit. Incoming frame sizes were previously unchecked, so a frame header declaring up to 4 GiB made the client buffer, and repeatedly re-copy, that much data before looking at it. An oversized frame is now refused from its header alone and closes the connection with `Frame size N exceeds maxFrameSize M`. The limit is deliberately separate from the negotiated `frameMax`, since some brokers send larger frames without splitting them (see #784). **Upgrade note:** a broker that delivers an unsplit frame larger than the limit will now have that connection closed; pass `maxFrameSize: 0`, or a higher value, to restore the previous behaviour (GHSA-37f9-7m79-6866)

package/lib/codec.js

@@ -62,12 +62,20 @@ function isFloatingPoint(n) {
   return n >= 0x8000000000000000 || (Math.abs(n) < 0x4000000000000 && Math.floor(n) !== n);
 }
 
+function checkSpace(buffer, offset, size) {
+  if (offset + size > buffer.length) {
+    throw new RangeError(`Encoded field table (headers or arguments) exceeds the ${buffer.length} byte encoding buffer`);
+  }
+}
+
 function encodeTable(buffer, val, offset) {
   const start = offset;
+  checkSpace(buffer, offset, 4);
   offset += 4; // leave room for the table length
   for (const key in val) {
     if (val[key] !== undefined) {
       const len = Buffer.byteLength(key);
+      checkSpace(buffer, offset, 1 + len);
       buffer.writeUInt8(len, offset);
       offset++;
       buffer.write(key, offset, 'utf8');
@@ -82,6 +90,7 @@ function encodeTable(buffer, val, offset) {
 
 function encodeArray(buffer, val, offset) {
   const start = offset;
+  checkSpace(buffer, offset, 4);
   offset += 4;
   for (let i = 0, num = val.length; i < num; i++) {
     offset += encodeFieldValue(buffer, val[i], offset);
@@ -133,6 +142,7 @@ function encodeFieldValue(buffer, value, offset) {
   }
 
   function tag(t) {
+    checkSpace(buffer, offset, 1);
     buffer.write(t, offset);
     offset++;
   }
@@ -142,6 +152,7 @@ function encodeFieldValue(buffer, value, offset) {
       // no shortstr in field tables
       const len = Buffer.byteLength(val, 'utf8');
       tag('S');
+      checkSpace(buffer, offset, 4 + len);
       buffer.writeUInt32BE(len, offset);
       offset += 4;
       buffer.write(val, offset, 'utf8');
@@ -156,6 +167,7 @@ function encodeFieldValue(buffer, value, offset) {
         offset += encodeArray(buffer, val, offset);
       } else if (Buffer.isBuffer(val)) {
         tag('x');
+        checkSpace(buffer, offset, 4 + val.length);
         buffer.writeUInt32BE(val.length, offset);
         offset += 4;
         val.copy(buffer, offset);
@@ -167,6 +179,7 @@ function encodeFieldValue(buffer, value, offset) {
       break;
     case 'boolean':
       tag('t');
+      checkSpace(buffer, offset, 1);
       buffer.writeUInt8(val ? 1 : 0, offset);
       offset++;
       break;
@@ -175,48 +188,56 @@ function encodeFieldValue(buffer, value, offset) {
     case 'double':
     case 'float64':
       tag('d');
+      checkSpace(buffer, offset, 8);
       buffer.writeDoubleBE(val, offset);
       offset += 8;
       break;
     case 'byte':
     case 'int8':
       tag('b');
+      checkSpace(buffer, offset, 1);
       buffer.writeInt8(val, offset);
       offset++;
       break;
     case 'unsignedbyte':
     case 'uint8':
       tag('B');
+      checkSpace(buffer, offset, 1);
       buffer.writeUInt8(val, offset);
       offset++;
       break;
     case 'short':
     case 'int16':
       tag('s');
+      checkSpace(buffer, offset, 2);
       buffer.writeInt16BE(val, offset);
       offset += 2;
       break;
     case 'unsignedshort':
     case 'uint16':
       tag('u');
+      checkSpace(buffer, offset, 2);
       buffer.writeUInt16BE(val, offset);
       offset += 2;
       break;
     case 'int':
     case 'int32':
       tag('I');
+      checkSpace(buffer, offset, 4);
       buffer.writeInt32BE(val, offset);
       offset += 4;
       break;
     case 'unsignedint':
     case 'uint32':
       tag('i');
+      checkSpace(buffer, offset, 4);
       buffer.writeUInt32BE(val, offset);
       offset += 4;
       break;
     case 'long':
     case 'int64':
       tag('l');
+      checkSpace(buffer, offset, 8);
       buffer.writeBigInt64BE(BigInt(val), offset);
       offset += 8;
       break;
@@ -225,17 +246,20 @@ function encodeFieldValue(buffer, value, offset) {
     // `{'!': type, value: val}
     case 'timestamp':
       tag('T');
+      checkSpace(buffer, offset, 8);
       buffer.writeBigUInt64BE(BigInt(val), offset);
       offset += 8;
       break;
     case 'float':
       tag('f');
+      checkSpace(buffer, offset, 4);
       buffer.writeFloatBE(val, offset);
       offset += 4;
       break;
     case 'decimal':
       tag('D');
       if (Object.hasOwn(val, 'places') && Object.hasOwn(val, 'digits') && val.places >= 0 && val.places < 256) {
+        checkSpace(buffer, offset, 5);
         buffer[offset] = val.places;
         offset++;
         buffer.writeUInt32BE(val.digits, offset);

package/package.json

@@ -2,7 +2,7 @@
   "name": "amqplib",
   "homepage": "http://amqp-node.github.io/amqplib/",
   "main": "./channel_api.js",
-  "version": "2.3.0",
+  "version": "2.3.1",
   "types": "./index.d.ts",
   "exports": {
     ".": {