protobufjs 7.6.4 → 7.6.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "protobufjs",
-  "version": "7.6.4",
+  "version": "7.6.6",
   "versionScheme": "~",
   "description": "Protocol Buffers for JavaScript (& TypeScript).",
   "author": "Daniel Wirtz <dcode+protobufjs@dcode.io>",

package/src/decoder.js

@@ -22,7 +22,17 @@ function decoder(mtype) {
     ("if(n===undefined)n=0")
     ("if(n>Reader.recursionLimit)")
         ("throw Error(\"maximum nesting depth exceeded\")")
-    ("var c=l===undefined?r.len:r.pos+l,m=new this.ctor" + (mtype.fieldsArray.filter(function(field) { return field.map; }).length ? ",k,value" : ""))
+    ("var c,m" + (mtype.fieldsArray.filter(function(field) { return field.map; }).length ? ",k,value" : ""))
+    ("if(l===undefined)")
+        ("c=r.len")
+    ("else{")
+        ("c=r.pos+l")
+        ("if(c>r.len)")
+            ("throw RangeError(\"index out of range\")")
+        ("l=r.len")
+        ("r.len=c")
+    ("}")
+    ("m=new this.ctor")
     ("while(r.pos<c){")
         ("var t=r.uint32()")
         ("if(t===e)")
@@ -40,7 +50,10 @@ function decoder(mtype) {
         if (field.map) { gen
                 ("if(%s===util.emptyObject)", ref)
                     ("%s={}", ref)
-                ("var c2 = r.uint32()+r.pos");
+                ("var c2=r.uint32()+r.pos")
+                ("if(c2>r.len)")
+                    ("throw RangeError(\"index out of range\")")
+                ("r.len=c2");
 
             if (types.defaults[field.keyType] !== undefined) gen
                 ("k=%j", types.defaults[field.keyType]);
@@ -70,7 +83,10 @@ function decoder(mtype) {
                             ("r.skipType(tag2&7,n)")
                             ("break")
                     ("}")
-                ("}");
+                ("}")
+                ("if(r.pos!==c2)")
+                    ("throw RangeError(\"index out of range\")")
+                ("r.len=c");
 
             if (types.long[field.keyType] !== undefined) gen
                 ("%s[typeof k===\"object\"?util.longToHash(k):k]=value", ref);
@@ -92,8 +108,14 @@ function decoder(mtype) {
             if (types.packed[type] !== undefined) gen
                 ("if((t&7)===2){")
                     ("var c2=r.uint32()+r.pos")
+                    ("if(c2>r.len)")
+                        ("throw RangeError(\"index out of range\")")
+                    ("r.len=c2")
                     ("while(r.pos<c2)")
                         ("%s.push(r.%s())", ref, type)
+                    ("if(r.pos!==c2)")
+                        ("throw RangeError(\"index out of range\")")
+                    ("r.len=c")
                 ("}else");
 
             // Non-packed
@@ -121,6 +143,13 @@ function decoder(mtype) {
         ("}")
     ("}");
 
+    gen
+    ("if(l!==undefined){")
+        ("if(r.pos!==c)")
+            ("throw RangeError(\"index out of range\")")
+        ("r.len=l")
+    ("}");
+
     // Field presence
     for (i = 0; i < mtype._fieldsArray.length; ++i) {
         var rfield = mtype._fieldsArray[i];

package/src/parse.js

@@ -678,6 +678,9 @@ function parse(source, root, options) {
             }
 
             while (token !== "=") {
+                if (token === null) {
+                    throw illegal(token, "end of input");
+                }
                 if (token === "(") {
                     var parensValue = next();
                     skip(")");

package/src/reader.js

@@ -78,6 +78,20 @@ Reader.create = create();
 
 Reader.prototype._slice = util.Array.prototype.subarray || /* istanbul ignore next */ util.Array.prototype.slice;
 
+function readVarint32NearEnd(reader) {
+    // Safely read up to four bytes of a varint32 near the reader limit
+    var value = 0;
+    for (var i = 0; i < 4; ++i) {
+        if (reader.pos >= reader.len)
+            throw indexOutOfRange(reader);
+        var b = reader.buf[reader.pos++];
+        value = (value | (b & 127) << i * 7) >>> 0;
+        if (b < 128)
+            return value;
+    }
+    throw indexOutOfRange(reader);
+}
+
 /**
  * Reads a varint as an unsigned 32 bit value.
  * @function
@@ -86,6 +100,12 @@ Reader.prototype._slice = util.Array.prototype.subarray || /* istanbul ignore ne
 Reader.prototype.uint32 = (function read_uint32_setup() {
     var value = 4294967295; // optimizer type-hint, tends to deopt otherwise (?!)
     return function read_uint32() {
+        if (this.len - this.pos < 5) {
+            if (this.pos >= this.len)
+                throw indexOutOfRange(this);
+            if (this.buf[this.pos] >= 128)
+                return readVarint32NearEnd(this);
+        }
         value = (         this.buf[this.pos] & 127       ) >>> 0; if (this.buf[this.pos++] < 128) return value;
         value = (value | (this.buf[this.pos] & 127) <<  7) >>> 0; if (this.buf[this.pos++] < 128) return value;
         value = (value | (this.buf[this.pos] & 127) << 14) >>> 0; if (this.buf[this.pos++] < 128) return value;

package/src/wrappers.js

@@ -40,6 +40,10 @@ var Message = require("./message"),
 wrappers[".google.protobuf.Any"] = {
 
     fromObject: function(object, depth) {
+        if (depth === undefined)
+            depth = 0;
+        if (depth > util.recursionLimit)
+            throw Error("max depth exceeded");
 
         // unwrap value type if mapped
         if (object && object["@type"]) {
@@ -57,7 +61,7 @@ wrappers[".google.protobuf.Any"] = {
                 }
                 return this.create({
                     type_url: type_url,
-                    value: type.encode(type.fromObject(object, depth === undefined ? 1 : depth + 1)).finish()
+                    value: type.encode(type.fromObject(object, depth + 1)).finish()
                 });
             }
         }