cbor-x 1.6.5 → 1.6.7

package/dist/test.js

@@ -19,7 +19,11 @@
 	let maxArraySize = 112810000; // This is the maximum array size in V8. We would potentially detect and set it higher
 	// for JSC, but this is pretty large and should be sufficient for most use cases
 	let maxMapSize = 16810000; // JavaScript has a fixed maximum map size of about 16710000, but JS itself enforces this,
-	// many keys in an object, so also probably a reasonable choice there.
+	// so we don't need to
+
+	let maxObjectSize = 16710000; // It takes over a minute to create this many keys in an object, so this is probably a
+	// reasonable choice.
+	let objectSizeLimit = maxObjectSize; // objects are limited by both maxObjectSize and maxMapSize
 	let strings = EMPTY_ARRAY;
 	let stringPosition = 0;
 	let currentDecoder = {};
@@ -122,7 +126,13 @@
 				// re-entrant execution, save the state and restore it after we do this decode
 				return saveState(() => {
 					clearSource();
-					return this ? this.decode(source, end) : Decoder.prototype.decode.call(defaultOptions, source, end)
+					try {
+						return this ? this.decode(source, end) : Decoder.prototype.decode.call(defaultOptions, source, end)
+					} catch (error) {
+						if (error && typeof error == 'object')
+							nestedDecodeErrors.add(error);
+						throw error
+					}
 				})
 			}
 			srcEnd = end > -1 ? end : source.length;
@@ -199,15 +209,13 @@
 			}
 		}
 	}
+	const nestedDecodeErrors = new WeakSet();
 	function checkedRead() {
 		try {
 			let result = read();
 			if (bundledStrings$1) {
-				if (position$1 >= bundledStrings$1.postBundlePosition) {
-					let error = new Error('Unexpected bundle position');
-					error.incomplete = true;
-					throw error
-				}
+				if (position$1 >= bundledStrings$1.postBundlePosition)
+					throw new Error('Unexpected bundle position')
 				// bundled strings to skip past
 				position$1 = bundledStrings$1.postBundlePosition;
 				bundledStrings$1 = null;
@@ -231,20 +239,36 @@
 			return result
 		} catch(error) {
 			clearSource();
-			if (error instanceof RangeError || error.message.startsWith('Unexpected end of buffer')) {
+			if (nestedDecodeErrors.has(error)) {
+				// from a nested decode of embedded data (by an extension), which was complete in this source
+				if (error.incomplete)
+					error.incomplete = false;
+			} else if (error instanceof RangeError && position$1 + 8 > srcEnd ||
+					error && typeof error.message == 'string' && error.message.startsWith('Unexpected end of buffer')) {
+				// a DataView read past the end of the source; these read at most 8 bytes and precede advancing position.
+				// Any other RangeError (such as a stack overflow from deeply nested input) is fatal.
 				error.incomplete = true;
 			}
 			throw error
 		}
 	}
 
+	function endOfCBORError() {
+		let error = new Error('Unexpected end of CBOR data');
+		error.incomplete = true;
+		return error
+	}
+
 	function read() {
+		// compared as < so that a NaN position (from a corrupt length) also throws instead of reading undefined
+		if (!(position$1 < srcEnd)) throw endOfCBORError()
 		let token = src[position$1++];
 		let majorType = token >> 5;
 		token = token & 0x1f;
 		if (token > 0x17) {
 			switch (token) {
 				case 0x18:
+					if (position$1 >= srcEnd) throw endOfCBORError()
 					token = src[position$1++];
 					break
 				case 0x19:
@@ -307,13 +331,13 @@
 								let i = 0;
 								if (currentDecoder.keyMap) {
 									while((key = read()) != STOP_CODE) {
-										if (i++ >= maxMapSize) throw new Error(`Property count exceeds ${maxMapSize}`)
+										if (i++ >= objectSizeLimit) throw new Error(`Property count exceeds ${objectSizeLimit}`)
 										object[safeKey(currentDecoder.decodeKey(key))] = read();
 									}
 								}
 								else {
 									while ((key = read()) != STOP_CODE) {
-										if (i++ >= maxMapSize) throw new Error(`Property count exceeds ${maxMapSize}`)
+										if (i++ >= objectSizeLimit) throw new Error(`Property count exceeds ${objectSizeLimit}`)
 										object[safeKey(key)] = read();
 									}
 								}
@@ -359,11 +383,13 @@
 			case 1: // negative int
 				return ~token
 			case 2: // buffer
+				if (token > srcEnd - position$1) throw endOfCBORError()
 				return readBin(token)
 			case 3: // string
-				if (srcStringEnd >= position$1) {
+				if (srcStringEnd >= position$1) { // already extracted, which only covers complete strings
 					return srcString.slice(position$1 - srcStringStart, (position$1 += token) - srcStringStart)
 				}
+				if (token > srcEnd - position$1) throw endOfCBORError()
 				if (srcStringEnd == 0 && srcEnd < 140 && token < 32) {
 					// for small blocks, avoiding the overhead of the extract call is helpful
 					let string = token < 16 ? shortStringInJS(token) : longStringInJS(token);
@@ -372,15 +398,19 @@
 				}
 				return readFixedString(token)
 			case 4: // array
-				if (token >= maxArraySize) throw new Error(`Array length exceeds ${maxArraySize}`)
+				if (token > maxArraySize) throw new Error(`Array length exceeds ${maxArraySize}`)
+				// every element occupies at least one byte, so a length beyond what remains in the source can
+				// never be satisfied; check before allocating so a tiny header can not force a huge allocation
+				if (token > srcEnd - position$1) throw endOfCBORError()
 				let array = new Array(token);
 			  //if (currentDecoder.keyMap) for (let i = 0; i < token; i++) array[i] = currentDecoder.decodeKey(read())	
 				//else 
 				for (let i = 0; i < token; i++) array[i] = read();
 				return array
 			case 5: // map
-				if (token >= maxMapSize) throw new Error(`Map size exceeds ${maxArraySize}`)
 				if (currentDecoder.mapsAsObjects) {
+					if (token > objectSizeLimit) throw new Error(`Property count exceeds ${objectSizeLimit}`)
+					if (token > (srcEnd - position$1) / 2) throw endOfCBORError() // each entry needs at least two bytes
 					let object = {};
 					if (currentDecoder.keyMap) for (let i = 0; i < token; i++) object[safeKey(currentDecoder.decodeKey(read()))] = read();
 					else for (let i = 0; i < token; i++) object[safeKey(read())] = read();
@@ -390,6 +420,8 @@
 						currentDecoder.mapsAsObjects = true;
 						restoreMapsAsObject = false;
 					}
+					if (token > maxMapSize) throw new Error(`Map size exceeds ${maxMapSize}`)
+					if (token > (srcEnd - position$1) / 2) throw endOfCBORError()
 					let map = new Map();
 					if (currentDecoder.keyMap) for (let i = 0; i < token; i++) map.set(currentDecoder.decodeKey(read()),read());
 					else for (let i = 0; i < token; i++) map.set(read(), read());
@@ -471,11 +503,7 @@
 						throw new Error('Unknown token ' + token)
 				}
 			default: // negative int
-				if (isNaN(token)) {
-					let error = new Error('Unexpected end of CBOR data');
-					error.incomplete = true;
-					throw error
-				}
+				if (isNaN(token)) throw endOfCBORError()
 				throw new Error('Unknown CBOR token ' + token)
 		}
 	}
@@ -921,18 +949,12 @@
 		return (glbl[data[0]] || Error)(data[1], data[2])
 	};
 	const packedTable = (read) => {
-		if (src[position$1++] != 0x84) {
-			let error = new Error('Packed values structure must be followed by a 4 element array');
-			if (src.length < position$1)
-				error.incomplete = true;
-			throw error
-		}
+		if (!(position$1 < srcEnd)) throw endOfCBORError()
+		if (src[position$1++] != 0x84)
+			throw new Error('Packed values structure must be followed by a 4 element array')
 		let newPackedValues = read(); // packed values
-		if (!newPackedValues || !newPackedValues.length) {
-			let error = new Error('Packed values structure must be followed by a 4 element array');
-			error.incomplete = true;
-			throw error
-		}
+		if (!Array.isArray(newPackedValues) || !newPackedValues.length)
+			throw new Error('Packed values structure must be followed by a 4 element array')
 		packedValues = packedValues ? newPackedValues.concat(packedValues.slice(newPackedValues.length)) : newPackedValues;
 		packedValues.prefixes = read();
 		packedValues.suffixes = read();
@@ -950,10 +972,7 @@
 		}
 		if (typeof data == 'number')
 			return packedValues[16 + (data >= 0 ? 2 * data : (-2 * data - 1))]
-		let error = new Error('No support for non-integer packed references yet');
-		if (data === undefined)
-			error.incomplete = true;
-		throw error
+		throw new Error('No support for non-integer packed references yet')
 	};
 
 	// The following code is an incomplete implementation of http://cbor.schmorp.de/stringref
@@ -1023,9 +1042,19 @@
 	(currentExtensions[259] = (read) => {
 		// https://github.com/shanewholloway/js-cbor-codec/blob/master/docs/CBOR-259-spec
 		// for decoding as a standard Map
-		if (currentDecoder.mapsAsObjects) {
-			currentDecoder.mapsAsObjects = false;
+		let decoder = currentDecoder;
+		if (decoder.mapsAsObjects) {
+			decoder.mapsAsObjects = false;
 			restoreMapsAsObject = true;
+			try {
+				return read()
+			} finally {
+				// normally restored by the map header, but not if the tagged value is not a map or the read fails
+				if (restoreMapsAsObject) {
+					decoder.mapsAsObjects = true;
+					restoreMapsAsObject = false;
+				}
+			}
 		}
 		return read()
 	}).handlesRead = true;
@@ -1136,17 +1165,21 @@
 	}
 
 	function readJustLength() {
+		if (!(position$1 < srcEnd)) throw endOfCBORError()
 		let token = src[position$1++] & 0x1f;
 		if (token > 0x17) {
 			switch (token) {
 				case 0x18:
+					if (position$1 >= srcEnd) throw endOfCBORError()
 					token = src[position$1++];
 					break
 				case 0x19:
+					if (position$1 + 2 > srcEnd) throw endOfCBORError()
 					token = dataView.getUint16(position$1);
 					position$1 += 2;
 					break
 				case 0x1a:
+					if (position$1 + 4 > srcEnd) throw endOfCBORError()
 					token = dataView.getUint32(position$1);
 					position$1 += 4;
 					break
@@ -1188,22 +1221,27 @@
 		let savedStructures = currentStructures;
 		let savedDecoder = currentDecoder;
 		let savedSequentialMode = sequentialMode;
-		let value = callback();
-		srcEnd = savedSrcEnd;
-		position$1 = savedPosition;
-		stringPosition = savedStringPosition;
-		srcStringStart = savedSrcStringStart;
-		srcStringEnd = savedSrcStringEnd;
-		srcString = savedSrcString;
-		strings = savedStrings;
-		referenceMap = savedReferenceMap;
-		bundledStrings$1 = savedBundledStrings;
-		src = savedSrc;
-		sequentialMode = savedSequentialMode;
-		currentStructures = savedStructures;
-		currentDecoder = savedDecoder;
-		dataView = new DataView(src.buffer, src.byteOffset, src.byteLength);
-		return value
+		let savedRestoreMapsAsObject = restoreMapsAsObject;
+		restoreMapsAsObject = false;
+		try {
+			return callback()
+		} finally {
+			srcEnd = savedSrcEnd;
+			position$1 = savedPosition;
+			stringPosition = savedStringPosition;
+			srcStringStart = savedSrcStringStart;
+			srcStringEnd = savedSrcStringEnd;
+			srcString = savedSrcString;
+			strings = savedStrings;
+			referenceMap = savedReferenceMap;
+			bundledStrings$1 = savedBundledStrings;
+			src = savedSrc;
+			sequentialMode = savedSequentialMode;
+			currentStructures = savedStructures;
+			currentDecoder = savedDecoder;
+			restoreMapsAsObject = savedRestoreMapsAsObject;
+			dataView = new DataView(src.buffer, src.byteOffset, src.byteLength);
+		}
 	}
 	function clearSource() {
 		src = null;
@@ -1409,7 +1447,7 @@
 					if (throwOnIterable)
 						return;
 					encode(value);
-					if (bundledStrings) {
+					if (bundledStrings && bundledStrings.position) { // position is only set once a bundle has been started
 						writeBundles(start, encode);
 					}
 					encoder.offset = position; // update the offset so next serialization doesn't write over our buffer, but can continue writing to same buffer sequentially