pixl-server-storage 3.0.9 → 3.0.10

package/engines/Couchbase.js

@@ -248,6 +248,13 @@ module.exports = Class.create({
 				return callback( err, null );
 			}
 			
+			// validate byte range, now that we have the head info
+			if ((start < 0) || (start >= buf.length) || (end < start) || (end >= buf.length)) {
+				download.destroy();
+				callback( new Error("Invalid byte range (" + start + '-' + end + ") for key: " + key + " (len: " + buf.length + ")"), null );
+				return;
+			}
+			
 			var range = buf.slice(start, end + 1);
 			var stream = new BufferStream(range);
 			callback(null, stream, { mod: 1, len: buf.length });

package/engines/Filesystem.js

@@ -479,6 +479,13 @@ module.exports = Class.create({
 				return callback( err, null );
 			}
 			
+			// validate byte range, now that we have the head info
+			if ((start < 0) || (start >= stats.size) || (end < start) || (end >= stats.size)) {
+				download.destroy();
+				callback( new Error("Invalid byte range (" + start + '-' + end + ") for key: " + key + " (len: " + stats.size + ")"), null );
+				return;
+			}
+			
 			// create read stream
 			var inp = fs.createReadStream( file, { start, end } );
 			

package/engines/Redis.js

@@ -252,6 +252,13 @@ module.exports = Class.create({
 				return callback( err, null );
 			}
 			
+			// validate byte range, now that we have the head info
+			if ((start < 0) || (start >= buf.length) || (end < start) || (end >= buf.length)) {
+				download.destroy();
+				callback( new Error("Invalid byte range (" + start + '-' + end + ") for key: " + key + " (len: " + buf.length + ")"), null );
+				return;
+			}
+			
 			var range = buf.slice(start, end + 1);
 			var stream = new BufferStream(range);
 			callback(null, stream, { mod: 1, len: buf.length });

package/engines/RedisCluster.js

@@ -269,6 +269,13 @@ module.exports = Class.create({
 				return callback( err, null );
 			}
 			
+			// validate byte range, now that we have the head info
+			if ((start < 0) || (start >= buf.length) || (end < start) || (end >= buf.length)) {
+				download.destroy();
+				callback( new Error("Invalid byte range (" + start + '-' + end + ") for key: " + key + " (len: " + buf.length + ")"), null );
+				return;
+			}
+			
 			var range = buf.slice(start, end + 1);
 			var stream = new BufferStream(range);
 			callback(null, stream, { mod: 1, len: buf.length });

package/engines/S3.js

@@ -365,6 +365,13 @@ module.exports = Class.create({
 				return;
 			}
 			
+			// validate byte range, now that we have the head info
+			if ((start < 0) || (start >= data.ContentLength) || (end < start) || (end >= data.ContentLength)) {
+				download.destroy();
+				callback( new Error("Invalid byte range (" + start + '-' + end + ") for key: " + key + " (len: " + data.ContentLength + ")"), null );
+				return;
+			}
+			
 			proceed = true;
 			callback( null, download, {
 				mod: Math.floor((new Date(data.LastModified)).getTime() / 1000),

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "pixl-server-storage",
-	"version": "3.0.9",
+	"version": "3.0.10",
 	"description": "A key/value/list storage component for the pixl-server framework.",
 	"author": "Joseph Huckaby <jhuckaby@gmail.com>",
 	"homepage": "https://github.com/jhuckaby/pixl-server-storage",