cbor-x 1.6.4 → 1.6.6

package/dist/node.cjs

@@ -3,6 +3,7 @@
 var stream = require('stream');
 var module$1 = require('module');
 
+var _documentCurrentScript = typeof document !== 'undefined' ? document.currentScript : null;
 let decoder;
 try {
 	decoder = new TextDecoder();
@@ -239,13 +240,22 @@ function checkedRead() {
 	}
 }
 
+function endOfCBORError() {
+	let error = new Error('Unexpected end of CBOR data');
+	error.incomplete = true;
+	return error
+}
+
 function read() {
+	// compared as < so that a NaN position (from a corrupt length) also throws instead of reading undefined
+	if (!(position$1 < srcEnd)) throw endOfCBORError()
 	let token = src[position$1++];
 	let majorType = token >> 5;
 	token = token & 0x1f;
 	if (token > 0x17) {
 		switch (token) {
 			case 0x18:
+				if (position$1 >= srcEnd) throw endOfCBORError()
 				token = src[position$1++];
 				break
 			case 0x19:
@@ -374,6 +384,9 @@ function read() {
 			return readFixedString(token)
 		case 4: // array
 			if (token >= maxArraySize) throw new Error(`Array length exceeds ${maxArraySize}`)
+			// every element occupies at least one byte, so a length beyond what remains in the source can
+			// never be satisfied; check before allocating so a tiny header can not force a huge allocation
+			if (token > srcEnd - position$1) throw endOfCBORError()
 			let array = new Array(token);
 		  //if (currentDecoder.keyMap) for (let i = 0; i < token; i++) array[i] = currentDecoder.decodeKey(read())	
 			//else 
@@ -381,6 +394,7 @@ function read() {
 			return array
 		case 5: // map
 			if (token >= maxMapSize) throw new Error(`Map size exceeds ${maxArraySize}`)
+			if (token > (srcEnd - position$1) / 2) throw endOfCBORError() // each entry needs at least two bytes
 			if (currentDecoder.mapsAsObjects) {
 				let object = {};
 				if (currentDecoder.keyMap) for (let i = 0; i < token; i++) object[safeKey(currentDecoder.decodeKey(read()))] = read();
@@ -472,11 +486,7 @@ function read() {
 					throw new Error('Unknown token ' + token)
 			}
 		default: // negative int
-			if (isNaN(token)) {
-				let error = new Error('Unexpected end of CBOR data');
-				error.incomplete = true;
-				throw error
-			}
+			if (isNaN(token)) throw endOfCBORError()
 			throw new Error('Unknown CBOR token ' + token)
 	}
 }
@@ -600,43 +610,49 @@ function readStringJS(length) {
 			units.push(byte1);
 		} else if ((byte1 & 0xe0) === 0xc0) {
 			// 2 bytes
-			const byte2 = src[position$1++] & 0x3f;
-			const codePoint = ((byte1 & 0x1f) << 6) | byte2;
-			// Reject overlong encoding: 2-byte sequences must encode values >= 0x80
-			if (codePoint < 0x80) {
-				units.push(0xFFFD); // replacement character
+			if (byte1 < 0xc2 || position$1 >= end || (src[position$1] & 0xc0) !== 0x80) {
+				units.push(0xFFFD);
 			} else {
-				units.push(codePoint);
+				const byte2 = src[position$1++] & 0x3f;
+				units.push(((byte1 & 0x1f) << 6) | byte2);
 			}
 		} else if ((byte1 & 0xf0) === 0xe0) {
 			// 3 bytes
-			const byte2 = src[position$1++] & 0x3f;
-			const byte3 = src[position$1++] & 0x3f;
-			const codePoint = ((byte1 & 0x1f) << 12) | (byte2 << 6) | byte3;
-			// Reject overlong encoding: 3-byte sequences must encode values >= 0x800
-			// Also reject surrogates (0xD800-0xDFFF)
-			if (codePoint < 0x800 || (codePoint >= 0xD800 && codePoint <= 0xDFFF)) {
-				units.push(0xFFFD); // replacement character
+			const byte2 = position$1 < end ? src[position$1] : 0;
+			if (position$1 >= end || (byte2 & 0xc0) !== 0x80 ||
+				(byte1 === 0xe0 && byte2 < 0xa0) || (byte1 === 0xed && byte2 >= 0xa0)) {
+				units.push(0xFFFD);
 			} else {
-				units.push(codePoint);
+				position$1++;
+				if (position$1 >= end || (src[position$1] & 0xc0) !== 0x80) {
+					units.push(0xFFFD);
+				} else {
+					const byte3 = src[position$1++] & 0x3f;
+					units.push(((byte1 & 0x1f) << 12) | ((byte2 & 0x3f) << 6) | byte3);
+				}
 			}
 		} else if ((byte1 & 0xf8) === 0xf0) {
 			// 4 bytes
-			const byte2 = src[position$1++] & 0x3f;
-			const byte3 = src[position$1++] & 0x3f;
-			const byte4 = src[position$1++] & 0x3f;
-			let unit = ((byte1 & 0x07) << 0x12) | (byte2 << 0x0c) | (byte3 << 0x06) | byte4;
-			// Reject overlong encoding: 4-byte sequences must encode values >= 0x10000
-			// Also reject values > 0x10FFFF (maximum valid Unicode)
-			if (unit < 0x10000 || unit > 0x10FFFF) {
-				units.push(0xFFFD); // replacement character
-			} else if (unit > 0xffff) {
-				unit -= 0x10000;
-				units.push(((unit >>> 10) & 0x3ff) | 0xd800);
-				unit = 0xdc00 | (unit & 0x3ff);
-				units.push(unit);
+			const byte2 = position$1 < end ? src[position$1] : 0;
+			if (byte1 > 0xf4 || position$1 >= end || (byte2 & 0xc0) !== 0x80 ||
+				(byte1 === 0xf0 && byte2 < 0x90) || (byte1 === 0xf4 && byte2 >= 0x90)) {
+				units.push(0xFFFD);
 			} else {
-				units.push(unit);
+				position$1++;
+				if (position$1 >= end || (src[position$1] & 0xc0) !== 0x80) {
+					units.push(0xFFFD);
+				} else {
+					const byte3 = src[position$1++] & 0x3f;
+					if (position$1 >= end || (src[position$1] & 0xc0) !== 0x80) {
+						units.push(0xFFFD);
+					} else {
+						const byte4 = src[position$1++] & 0x3f;
+						let unit = ((byte1 & 0x07) << 0x12) | ((byte2 & 0x3f) << 0x0c) | (byte3 << 0x06) | byte4;
+						unit -= 0x10000;
+						units.push(((unit >>> 10) & 0x3ff) | 0xd800);
+						units.push(0xdc00 | (unit & 0x3ff));
+					}
+				}
 			}
 		} else {
 			units.push(0xFFFD); // replacement character for invalid lead byte
@@ -1134,10 +1150,12 @@ function readBundleExt() {
 }
 
 function readJustLength() {
+	if (!(position$1 < srcEnd)) throw endOfCBORError()
 	let token = src[position$1++] & 0x1f;
 	if (token > 0x17) {
 		switch (token) {
 			case 0x18:
+				if (position$1 >= srcEnd) throw endOfCBORError()
 				token = src[position$1++];
 				break
 			case 0x19:
@@ -2621,7 +2639,7 @@ if (!nativeAccelerationDisabled) {
 		if (typeof require == 'function')
 			extractor = require('cbor-extract');
 		else
-			extractor = module$1.createRequire((typeof document === 'undefined' ? new (require('u' + 'rl').URL)('file:' + __filename).href : (document.currentScript && document.currentScript.src || new URL('node.cjs', document.baseURI).href)))('cbor-extract');
+			extractor = module$1.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('node.cjs', document.baseURI).href)))('cbor-extract');
 		if (extractor)
 			setExtractor(extractor.extractStrings);
 	} catch (error) {