hedgequantx 2.9.241 → 2.9.242
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/package.json
CHANGED
|
@@ -99,15 +99,24 @@ function skipField(buffer, offset, wireType) {
|
|
|
99
99
|
case 0: // Varint
|
|
100
100
|
const [, newOffset] = readVarint(buffer, offset);
|
|
101
101
|
return newOffset;
|
|
102
|
-
case 1: // 64-bit
|
|
102
|
+
case 1: // 64-bit (fixed64, sfixed64, double)
|
|
103
103
|
return offset + 8;
|
|
104
|
-
case 2: // Length-delimited
|
|
104
|
+
case 2: // Length-delimited (string, bytes, embedded messages, packed repeated)
|
|
105
105
|
const [length, lenOffset] = readVarint(buffer, offset);
|
|
106
106
|
return lenOffset + length;
|
|
107
|
-
case
|
|
107
|
+
case 3: // Start group (deprecated)
|
|
108
|
+
case 4: // End group (deprecated)
|
|
109
|
+
// Groups are deprecated, skip to end of buffer
|
|
110
|
+
return buffer.length;
|
|
111
|
+
case 5: // 32-bit (fixed32, sfixed32, float)
|
|
108
112
|
return offset + 4;
|
|
113
|
+
case 6: // Reserved (unused)
|
|
114
|
+
case 7: // Reserved (unused) - indicates corrupted data
|
|
115
|
+
// Skip to end to prevent infinite loops on corrupted data
|
|
116
|
+
return buffer.length;
|
|
109
117
|
default:
|
|
110
|
-
|
|
118
|
+
// Unknown wire type - skip to end
|
|
119
|
+
return buffer.length;
|
|
111
120
|
}
|
|
112
121
|
}
|
|
113
122
|
|
|
@@ -93,8 +93,15 @@ class ProtobufHandler {
|
|
|
93
93
|
// Skip 4-byte length prefix
|
|
94
94
|
const data = buffer.length > 4 ? buffer.slice(4) : buffer;
|
|
95
95
|
|
|
96
|
+
// Sanity check: buffer must be at least a few bytes
|
|
97
|
+
if (data.length < 2) return -1;
|
|
98
|
+
|
|
96
99
|
let offset = 0;
|
|
97
|
-
|
|
100
|
+
let iterations = 0;
|
|
101
|
+
const maxIterations = 100; // Prevent infinite loops on corrupted data
|
|
102
|
+
|
|
103
|
+
while (offset < data.length && iterations < maxIterations) {
|
|
104
|
+
iterations++;
|
|
98
105
|
try {
|
|
99
106
|
const [tag, newOffset] = readVarint(data, offset);
|
|
100
107
|
const fieldNumber = tag >>> 3;
|
|
@@ -106,7 +113,11 @@ class ProtobufHandler {
|
|
|
106
113
|
return templateId;
|
|
107
114
|
}
|
|
108
115
|
|
|
116
|
+
const prevOffset = offset;
|
|
109
117
|
offset = skipField(data, offset, wireType);
|
|
118
|
+
|
|
119
|
+
// Ensure we're making progress (prevent infinite loop)
|
|
120
|
+
if (offset <= prevOffset) break;
|
|
110
121
|
} catch (e) {
|
|
111
122
|
break;
|
|
112
123
|
}
|