cbor-x 1.6.7 → 1.6.8

package/dist/test.js

@@ -210,8 +210,10 @@
 		}
 	}
 	const nestedDecodeErrors = new WeakSet();
+	let arrayAllocationBudget;
 	function checkedRead() {
 		try {
+			arrayAllocationBudget = srcEnd - position$1;
 			let result = read();
 			if (bundledStrings$1) {
 				if (position$1 >= bundledStrings$1.postBundlePosition)
@@ -401,7 +403,9 @@
 				if (token > maxArraySize) throw new Error(`Array length exceeds ${maxArraySize}`)
 				// every element occupies at least one byte, so a length beyond what remains in the source can
 				// never be satisfied; check before allocating so a tiny header can not force a huge allocation
-				if (token > srcEnd - position$1) throw endOfCBORError()
+				// nested arrays each pass the check above yet still preallocate, so also spend from a
+				// per-decode budget of the remaining bytes; the summed lengths of any valid tree stay under it
+				if (token > srcEnd - position$1 || (arrayAllocationBudget -= token) < 0) throw endOfCBORError()
 				let array = new Array(token);
 			  //if (currentDecoder.keyMap) for (let i = 0; i < token; i++) array[i] = currentDecoder.decodeKey(read())	
 				//else 
@@ -1222,6 +1226,7 @@
 		let savedDecoder = currentDecoder;
 		let savedSequentialMode = sequentialMode;
 		let savedRestoreMapsAsObject = restoreMapsAsObject;
+		let savedArrayAllocationBudget = arrayAllocationBudget;
 		restoreMapsAsObject = false;
 		try {
 			return callback()
@@ -1240,6 +1245,7 @@
 			currentStructures = savedStructures;
 			currentDecoder = savedDecoder;
 			restoreMapsAsObject = savedRestoreMapsAsObject;
+			arrayAllocationBudget = savedArrayAllocationBudget;
 			dataView = new DataView(src.buffer, src.byteOffset, src.byteLength);
 		}
 	}