cbor-x 1.6.5 → 1.6.6

package/dist/index.js

@@ -234,13 +234,22 @@
 		}
 	}
 
+	function endOfCBORError() {
+		let error = new Error('Unexpected end of CBOR data');
+		error.incomplete = true;
+		return error
+	}
+
 	function read() {
+		// compared as < so that a NaN position (from a corrupt length) also throws instead of reading undefined
+		if (!(position$1 < srcEnd)) throw endOfCBORError()
 		let token = src[position$1++];
 		let majorType = token >> 5;
 		token = token & 0x1f;
 		if (token > 0x17) {
 			switch (token) {
 				case 0x18:
+					if (position$1 >= srcEnd) throw endOfCBORError()
 					token = src[position$1++];
 					break
 				case 0x19:
@@ -369,6 +378,9 @@
 				return readFixedString(token)
 			case 4: // array
 				if (token >= maxArraySize) throw new Error(`Array length exceeds ${maxArraySize}`)
+				// every element occupies at least one byte, so a length beyond what remains in the source can
+				// never be satisfied; check before allocating so a tiny header can not force a huge allocation
+				if (token > srcEnd - position$1) throw endOfCBORError()
 				let array = new Array(token);
 			  //if (currentDecoder.keyMap) for (let i = 0; i < token; i++) array[i] = currentDecoder.decodeKey(read())	
 				//else 
@@ -376,6 +388,7 @@
 				return array
 			case 5: // map
 				if (token >= maxMapSize) throw new Error(`Map size exceeds ${maxArraySize}`)
+				if (token > (srcEnd - position$1) / 2) throw endOfCBORError() // each entry needs at least two bytes
 				if (currentDecoder.mapsAsObjects) {
 					let object = {};
 					if (currentDecoder.keyMap) for (let i = 0; i < token; i++) object[safeKey(currentDecoder.decodeKey(read()))] = read();
@@ -467,11 +480,7 @@
 						throw new Error('Unknown token ' + token)
 				}
 			default: // negative int
-				if (isNaN(token)) {
-					let error = new Error('Unexpected end of CBOR data');
-					error.incomplete = true;
-					throw error
-				}
+				if (isNaN(token)) throw endOfCBORError()
 				throw new Error('Unknown CBOR token ' + token)
 		}
 	}
@@ -1100,10 +1109,12 @@
 	}
 
 	function readJustLength() {
+		if (!(position$1 < srcEnd)) throw endOfCBORError()
 		let token = src[position$1++] & 0x1f;
 		if (token > 0x17) {
 			switch (token) {
 				case 0x18:
+					if (position$1 >= srcEnd) throw endOfCBORError()
 					token = src[position$1++];
 					break
 				case 0x19: