cbor-x 1.6.7 → 1.6.8

package/dist/index.js

@@ -207,8 +207,10 @@
 		}
 	}
 	const nestedDecodeErrors = new WeakSet();
+	let arrayAllocationBudget;
 	function checkedRead() {
 		try {
+			arrayAllocationBudget = srcEnd - position$1;
 			let result = read();
 			if (bundledStrings$1) {
 				if (position$1 >= bundledStrings$1.postBundlePosition)
@@ -398,7 +400,9 @@
 				if (token > maxArraySize) throw new Error(`Array length exceeds ${maxArraySize}`)
 				// every element occupies at least one byte, so a length beyond what remains in the source can
 				// never be satisfied; check before allocating so a tiny header can not force a huge allocation
-				if (token > srcEnd - position$1) throw endOfCBORError()
+				// nested arrays each pass the check above yet still preallocate, so also spend from a
+				// per-decode budget of the remaining bytes; the summed lengths of any valid tree stay under it
+				if (token > srcEnd - position$1 || (arrayAllocationBudget -= token) < 0) throw endOfCBORError()
 				let array = new Array(token);
 			  //if (currentDecoder.keyMap) for (let i = 0; i < token; i++) array[i] = currentDecoder.decodeKey(read())	
 				//else 
@@ -1185,6 +1189,7 @@
 		let savedDecoder = currentDecoder;
 		let savedSequentialMode = sequentialMode;
 		let savedRestoreMapsAsObject = restoreMapsAsObject;
+		let savedArrayAllocationBudget = arrayAllocationBudget;
 		restoreMapsAsObject = false;
 		try {
 			return callback()
@@ -1201,6 +1206,7 @@
 			currentStructures = savedStructures;
 			currentDecoder = savedDecoder;
 			restoreMapsAsObject = savedRestoreMapsAsObject;
+			arrayAllocationBudget = savedArrayAllocationBudget;
 			dataView = new DataView(src.buffer, src.byteOffset, src.byteLength);
 		}
 	}