cbor-x 1.6.3 → 1.6.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (16) hide show
  1. package/decode.js +40 -15
  2. package/dist/decode-no-eval.cjs +40 -15
  3. package/dist/decode-no-eval.cjs.map +1 -1
  4. package/dist/index-no-eval.cjs +40 -15
  5. package/dist/index-no-eval.cjs.map +1 -1
  6. package/dist/index-no-eval.min.js +1 -1
  7. package/dist/index-no-eval.min.js.map +1 -1
  8. package/dist/index.js +40 -15
  9. package/dist/index.js.map +1 -1
  10. package/dist/index.min.js +1 -1
  11. package/dist/index.min.js.map +1 -1
  12. package/dist/node.cjs +42 -16
  13. package/dist/node.cjs.map +1 -1
  14. package/dist/test.js +49 -17
  15. package/dist/test.js.map +1 -1
  16. package/package.json +2 -2
package/dist/index-no-eval.cjs CHANGED
@@ -561,27 +561,52 @@
561
561
  units.push(byte1);
562
562
  } else if ((byte1 & 0xe0) === 0xc0) {
563
563
  // 2 bytes
564
- const byte2 = src[position$1++] & 0x3f;
565
- units.push(((byte1 & 0x1f) << 6) | byte2);
564
+ if (byte1 < 0xc2 || position$1 >= end || (src[position$1] & 0xc0) !== 0x80) {
565
+ units.push(0xFFFD);
566
+ } else {
567
+ const byte2 = src[position$1++] & 0x3f;
568
+ units.push(((byte1 & 0x1f) << 6) | byte2);
569
+ }
566
570
  } else if ((byte1 & 0xf0) === 0xe0) {
567
571
  // 3 bytes
568
- const byte2 = src[position$1++] & 0x3f;
569
- const byte3 = src[position$1++] & 0x3f;
570
- units.push(((byte1 & 0x1f) << 12) | (byte2 << 6) | byte3);
572
+ const byte2 = position$1 < end ? src[position$1] : 0;
573
+ if (position$1 >= end || (byte2 & 0xc0) !== 0x80 ||
574
+ (byte1 === 0xe0 && byte2 < 0xa0) || (byte1 === 0xed && byte2 >= 0xa0)) {
575
+ units.push(0xFFFD);
576
+ } else {
577
+ position$1++;
578
+ if (position$1 >= end || (src[position$1] & 0xc0) !== 0x80) {
579
+ units.push(0xFFFD);
580
+ } else {
581
+ const byte3 = src[position$1++] & 0x3f;
582
+ units.push(((byte1 & 0x1f) << 12) | ((byte2 & 0x3f) << 6) | byte3);
583
+ }
584
+ }
571
585
  } else if ((byte1 & 0xf8) === 0xf0) {
572
586
  // 4 bytes
573
- const byte2 = src[position$1++] & 0x3f;
574
- const byte3 = src[position$1++] & 0x3f;
575
- const byte4 = src[position$1++] & 0x3f;
576
- let unit = ((byte1 & 0x07) << 0x12) | (byte2 << 0x0c) | (byte3 << 0x06) | byte4;
577
- if (unit > 0xffff) {
578
- unit -= 0x10000;
579
- units.push(((unit >>> 10) & 0x3ff) | 0xd800);
580
- unit = 0xdc00 | (unit & 0x3ff);
587
+ const byte2 = position$1 < end ? src[position$1] : 0;
588
+ if (byte1 > 0xf4 || position$1 >= end || (byte2 & 0xc0) !== 0x80 ||
589
+ (byte1 === 0xf0 && byte2 < 0x90) || (byte1 === 0xf4 && byte2 >= 0x90)) {
590
+ units.push(0xFFFD);
591
+ } else {
592
+ position$1++;
593
+ if (position$1 >= end || (src[position$1] & 0xc0) !== 0x80) {
594
+ units.push(0xFFFD);
595
+ } else {
596
+ const byte3 = src[position$1++] & 0x3f;
597
+ if (position$1 >= end || (src[position$1] & 0xc0) !== 0x80) {
598
+ units.push(0xFFFD);
599
+ } else {
600
+ const byte4 = src[position$1++] & 0x3f;
601
+ let unit = ((byte1 & 0x07) << 0x12) | ((byte2 & 0x3f) << 0x0c) | (byte3 << 0x06) | byte4;
602
+ unit -= 0x10000;
603
+ units.push(((unit >>> 10) & 0x3ff) | 0xd800);
604
+ units.push(0xdc00 | (unit & 0x3ff));
605
+ }
606
+ }
581
607
  }
582
- units.push(unit);
583
608
  } else {
584
- units.push(byte1);
609
+ units.push(0xFFFD); // replacement character for invalid lead byte
585
610
  }
586
611
 
587
612
  if (units.length >= 0x1000) {