cbor-x 1.6.3 → 1.6.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (16) hide show
  1. package/decode.js +40 -15
  2. package/dist/decode-no-eval.cjs +40 -15
  3. package/dist/decode-no-eval.cjs.map +1 -1
  4. package/dist/index-no-eval.cjs +40 -15
  5. package/dist/index-no-eval.cjs.map +1 -1
  6. package/dist/index-no-eval.min.js +1 -1
  7. package/dist/index-no-eval.min.js.map +1 -1
  8. package/dist/index.js +40 -15
  9. package/dist/index.js.map +1 -1
  10. package/dist/index.min.js +1 -1
  11. package/dist/index.min.js.map +1 -1
  12. package/dist/node.cjs +42 -16
  13. package/dist/node.cjs.map +1 -1
  14. package/dist/test.js +49 -17
  15. package/dist/test.js.map +1 -1
  16. package/package.json +2 -2
package/dist/index.js CHANGED
@@ -560,27 +560,52 @@
560
560
  units.push(byte1);
561
561
  } else if ((byte1 & 0xe0) === 0xc0) {
562
562
  // 2 bytes
563
- const byte2 = src[position$1++] & 0x3f;
564
- units.push(((byte1 & 0x1f) << 6) | byte2);
563
+ if (byte1 < 0xc2 || position$1 >= end || (src[position$1] & 0xc0) !== 0x80) {
564
+ units.push(0xFFFD);
565
+ } else {
566
+ const byte2 = src[position$1++] & 0x3f;
567
+ units.push(((byte1 & 0x1f) << 6) | byte2);
568
+ }
565
569
  } else if ((byte1 & 0xf0) === 0xe0) {
566
570
  // 3 bytes
567
- const byte2 = src[position$1++] & 0x3f;
568
- const byte3 = src[position$1++] & 0x3f;
569
- units.push(((byte1 & 0x1f) << 12) | (byte2 << 6) | byte3);
571
+ const byte2 = position$1 < end ? src[position$1] : 0;
572
+ if (position$1 >= end || (byte2 & 0xc0) !== 0x80 ||
573
+ (byte1 === 0xe0 && byte2 < 0xa0) || (byte1 === 0xed && byte2 >= 0xa0)) {
574
+ units.push(0xFFFD);
575
+ } else {
576
+ position$1++;
577
+ if (position$1 >= end || (src[position$1] & 0xc0) !== 0x80) {
578
+ units.push(0xFFFD);
579
+ } else {
580
+ const byte3 = src[position$1++] & 0x3f;
581
+ units.push(((byte1 & 0x1f) << 12) | ((byte2 & 0x3f) << 6) | byte3);
582
+ }
583
+ }
570
584
  } else if ((byte1 & 0xf8) === 0xf0) {
571
585
  // 4 bytes
572
- const byte2 = src[position$1++] & 0x3f;
573
- const byte3 = src[position$1++] & 0x3f;
574
- const byte4 = src[position$1++] & 0x3f;
575
- let unit = ((byte1 & 0x07) << 0x12) | (byte2 << 0x0c) | (byte3 << 0x06) | byte4;
576
- if (unit > 0xffff) {
577
- unit -= 0x10000;
578
- units.push(((unit >>> 10) & 0x3ff) | 0xd800);
579
- unit = 0xdc00 | (unit & 0x3ff);
586
+ const byte2 = position$1 < end ? src[position$1] : 0;
587
+ if (byte1 > 0xf4 || position$1 >= end || (byte2 & 0xc0) !== 0x80 ||
588
+ (byte1 === 0xf0 && byte2 < 0x90) || (byte1 === 0xf4 && byte2 >= 0x90)) {
589
+ units.push(0xFFFD);
590
+ } else {
591
+ position$1++;
592
+ if (position$1 >= end || (src[position$1] & 0xc0) !== 0x80) {
593
+ units.push(0xFFFD);
594
+ } else {
595
+ const byte3 = src[position$1++] & 0x3f;
596
+ if (position$1 >= end || (src[position$1] & 0xc0) !== 0x80) {
597
+ units.push(0xFFFD);
598
+ } else {
599
+ const byte4 = src[position$1++] & 0x3f;
600
+ let unit = ((byte1 & 0x07) << 0x12) | ((byte2 & 0x3f) << 0x0c) | (byte3 << 0x06) | byte4;
601
+ unit -= 0x10000;
602
+ units.push(((unit >>> 10) & 0x3ff) | 0xd800);
603
+ units.push(0xdc00 | (unit & 0x3ff));
604
+ }
605
+ }
580
606
  }
581
- units.push(unit);
582
607
  } else {
583
- units.push(byte1);
608
+ units.push(0xFFFD); // replacement character for invalid lead byte
584
609
  }
585
610
 
586
611
  if (units.length >= 0x1000) {