cbor-x 1.6.5 → 1.6.6

package/dist/test.js

@@ -238,13 +238,22 @@
 		}
 	}
 
+	function endOfCBORError() {
+		let error = new Error('Unexpected end of CBOR data');
+		error.incomplete = true;
+		return error
+	}
+
 	function read() {
+		// compared as < so that a NaN position (from a corrupt length) also throws instead of reading undefined
+		if (!(position$1 < srcEnd)) throw endOfCBORError()
 		let token = src[position$1++];
 		let majorType = token >> 5;
 		token = token & 0x1f;
 		if (token > 0x17) {
 			switch (token) {
 				case 0x18:
+					if (position$1 >= srcEnd) throw endOfCBORError()
 					token = src[position$1++];
 					break
 				case 0x19:
@@ -373,6 +382,9 @@
 				return readFixedString(token)
 			case 4: // array
 				if (token >= maxArraySize) throw new Error(`Array length exceeds ${maxArraySize}`)
+				// every element occupies at least one byte, so a length beyond what remains in the source can
+				// never be satisfied; check before allocating so a tiny header can not force a huge allocation
+				if (token > srcEnd - position$1) throw endOfCBORError()
 				let array = new Array(token);
 			  //if (currentDecoder.keyMap) for (let i = 0; i < token; i++) array[i] = currentDecoder.decodeKey(read())	
 				//else 
@@ -380,6 +392,7 @@
 				return array
 			case 5: // map
 				if (token >= maxMapSize) throw new Error(`Map size exceeds ${maxArraySize}`)
+				if (token > (srcEnd - position$1) / 2) throw endOfCBORError() // each entry needs at least two bytes
 				if (currentDecoder.mapsAsObjects) {
 					let object = {};
 					if (currentDecoder.keyMap) for (let i = 0; i < token; i++) object[safeKey(currentDecoder.decodeKey(read()))] = read();
@@ -471,11 +484,7 @@
 						throw new Error('Unknown token ' + token)
 				}
 			default: // negative int
-				if (isNaN(token)) {
-					let error = new Error('Unexpected end of CBOR data');
-					error.incomplete = true;
-					throw error
-				}
+				if (isNaN(token)) throw endOfCBORError()
 				throw new Error('Unknown CBOR token ' + token)
 		}
 	}
@@ -1136,10 +1145,12 @@
 	}
 
 	function readJustLength() {
+		if (!(position$1 < srcEnd)) throw endOfCBORError()
 		let token = src[position$1++] & 0x1f;
 		if (token > 0x17) {
 			switch (token) {
 				case 0x18:
+					if (position$1 >= srcEnd) throw endOfCBORError()
 					token = src[position$1++];
 					break
 				case 0x19: