msgpackr 1.11.8 → 1.11.9

package/dist/node.cjs

@@ -621,26 +621,45 @@ function readStringJS(length) {
 		} else if ((byte1 & 0xe0) === 0xc0) {
 			// 2 bytes
 			const byte2 = src[position$1++] & 0x3f;
-			units.push(((byte1 & 0x1f) << 6) | byte2);
+			const codePoint = ((byte1 & 0x1f) << 6) | byte2;
+			// Reject overlong encoding: 2-byte sequences must encode values >= 0x80
+			if (codePoint < 0x80) {
+				units.push(0xFFFD); // replacement character
+			} else {
+				units.push(codePoint);
+			}
 		} else if ((byte1 & 0xf0) === 0xe0) {
 			// 3 bytes
 			const byte2 = src[position$1++] & 0x3f;
 			const byte3 = src[position$1++] & 0x3f;
-			units.push(((byte1 & 0x1f) << 12) | (byte2 << 6) | byte3);
+			const codePoint = ((byte1 & 0x1f) << 12) | (byte2 << 6) | byte3;
+			// Reject overlong encoding: 3-byte sequences must encode values >= 0x800
+			// Also reject surrogates (0xD800-0xDFFF)
+			if (codePoint < 0x800 || (codePoint >= 0xD800 && codePoint <= 0xDFFF)) {
+				units.push(0xFFFD); // replacement character
+			} else {
+				units.push(codePoint);
+			}
 		} else if ((byte1 & 0xf8) === 0xf0) {
 			// 4 bytes
 			const byte2 = src[position$1++] & 0x3f;
 			const byte3 = src[position$1++] & 0x3f;
 			const byte4 = src[position$1++] & 0x3f;
 			let unit = ((byte1 & 0x07) << 0x12) | (byte2 << 0x0c) | (byte3 << 0x06) | byte4;
-			if (unit > 0xffff) {
+			// Reject overlong encoding: 4-byte sequences must encode values >= 0x10000
+			// Also reject values > 0x10FFFF (maximum valid Unicode)
+			if (unit < 0x10000 || unit > 0x10FFFF) {
+				units.push(0xFFFD); // replacement character
+			} else if (unit > 0xffff) {
 				unit -= 0x10000;
 				units.push(((unit >>> 10) & 0x3ff) | 0xd800);
 				unit = 0xdc00 | (unit & 0x3ff);
+				units.push(unit);
+			} else {
+				units.push(unit);
 			}
-			units.push(unit);
 		} else {
-			units.push(byte1);
+			units.push(0xFFFD); // replacement character for invalid lead byte
 		}
 
 		if (units.length >= 0x1000) {