@nxtedition/slice - npm Package Compare versions

Comparing version 1.1.4 to 1.1.5

lib/index.d.ts

@@ -12,3 +12,3 @@ import util from 'node:util';
     maxByteLength: number;
-    static EMPTY_BUF: Buffer;
+    static get EMPTY_BUF(): Buffer;
     constructor(buffer?: Buffer<ArrayBufferLike>, byteOffset?: number, byteLength?: number, maxByteLength?: number);
@@ -28,7 +28,7 @@ reset(): void;
     get [Symbol.toStringTag](): string;
-    [util.inspect.custom](depth: number, options: util.InspectOptionsStylized, inspect: typeof util.inspect): string;
+    [util.inspect.custom](): string;
 }
 export declare class PoolAllocator {
     #private;
-    constructor(poolTotal?: number);
+    constructor(poolTotalOrBuffer?: Buffer | ArrayBufferView | ArrayBuffer | SharedArrayBuffer | number);
     get size(): number;
@@ -35,0 +35,0 @@ isFromPool(slice: Slice | null | undefined): boolean;

lib/index.js

@@ -17,3 +17,5 @@ import util from 'node:util'
 
-  static EMPTY_BUF         = EMPTY_BUF
+  static get EMPTY_BUF()         {
+    return EMPTY_BUF
+  }
 
@@ -75,2 +77,4 @@ constructor(
   )         {
+    const sliceEnd = this.byteOffset + this.byteLength
+
     if (sourceStart === undefined) {
@@ -83,3 +87,3 @@ sourceStart = this.byteOffset
     if (sourceEnd === undefined) {
-      sourceEnd = this.byteLength + this.byteOffset
+      sourceEnd = sliceEnd
     } else {
@@ -89,6 +93,10 @@ sourceEnd += this.byteOffset
 
-    let targetEnd                    
+    // Clamp against the logical slice length so copy() cannot read past
+    // the slice's own end and leak adjacent (pool) memory.
+    if (sourceEnd > sliceEnd) {
+      sourceEnd = sliceEnd
+    }
 
     if (target instanceof Slice) {
-      targetEnd = target.byteOffset + target.byteLength
+      const targetEnd = target.byteOffset + target.byteLength
       if (targetStart === undefined) {
@@ -101,3 +109,5 @@ targetStart = target.byteOffset
       target = target.buffer
-      sourceEnd = Math.min(sourceEnd, sourceStart + (targetEnd - targetStart))
+      if (sourceEnd - sourceStart > targetEnd - targetStart) {
+        sourceEnd = sourceStart + (targetEnd - targetStart)
+      }
     }
@@ -123,3 +133,16 @@
   )             {
+    if (
+      target === this &&
+      targetStart === undefined &&
+      targetEnd === undefined &&
+      sourceStart === undefined &&
+      sourceEnd === undefined
+    ) {
+      return 0
+    }
+
+    const sliceEnd = this.byteOffset + this.byteLength
+
     if (target instanceof Slice) {
+      const targetSliceEnd = target.byteOffset + target.byteLength
       if (targetStart === undefined) {
@@ -132,3 +155,3 @@ targetStart = target.byteOffset
       if (targetEnd === undefined) {
-        targetEnd = target.byteLength + target.byteOffset
+        targetEnd = targetSliceEnd
       } else {
@@ -138,2 +161,5 @@ targetEnd += target.byteOffset
 
+      if (targetEnd > targetSliceEnd) {
+        targetEnd = targetSliceEnd
+      }
       target = target.buffer
@@ -149,3 +175,3 @@ }
     if (sourceEnd === undefined) {
-      sourceEnd = this.byteLength + this.byteOffset
+      sourceEnd = sliceEnd
     } else {
@@ -155,2 +181,6 @@ sourceEnd += this.byteOffset
 
+    if (sourceEnd > sliceEnd) {
+      sourceEnd = sliceEnd
+    }
+
     return this.buffer.compare(target, targetStart, targetEnd, sourceStart, sourceEnd)
@@ -160,10 +190,18 @@ }
   write(string        , offset         , length         , encoding                 )         {
+    const sliceEnd = this.byteOffset + this.byteLength
+
     if (offset === undefined) {
       offset = this.byteOffset
     } else {
+      if (offset < 0 || offset > this.byteLength) {
+        throw new RangeError(`Invalid offset: ${offset}`)
+      }
       offset += this.byteOffset
     }
 
+    const available = sliceEnd - offset
     if (length === undefined) {
-      length = this.byteLength + this.byteOffset - offset
+      length = available
+    } else if (length > available) {
+      length = available
     }
@@ -204,2 +242,4 @@
   toString(encoding                 , start         , end         )         {
+    const sliceEnd = this.byteOffset + this.byteLength
+
     if (start === undefined) {
@@ -212,3 +252,3 @@ start = this.byteOffset
     if (end === undefined) {
-      end = this.byteLength + this.byteOffset
+      end = sliceEnd
     } else {
@@ -218,2 +258,6 @@ end += this.byteOffset
 
+    if (end > sliceEnd) {
+      end = sliceEnd
+    }
+
     return this.buffer.toString(encoding, start, end)
@@ -223,2 +267,4 @@ }
   toBuffer(start         , end         )         {
+    const sliceEnd = this.byteOffset + this.byteLength
+
     if (start === undefined) {
@@ -231,3 +277,3 @@ start = this.byteOffset
     if (end === undefined) {
-      end = this.byteLength + this.byteOffset
+      end = sliceEnd
     } else {
@@ -237,2 +283,6 @@ end += this.byteOffset
 
+    if (end > sliceEnd) {
+      end = sliceEnd
+    }
+
     return start === 0 && end === this.buffer.byteLength
@@ -244,15 +294,26 @@ ? this.buffer
   get [Symbol.toStringTag]()         {
-    return this.toString()
+    return 'Slice'
   }
 
-  [util.inspect.custom](
-    depth        ,
-    options                             ,
-    inspect                     ,
-  )         {
-    const bytes = []
-    for (let i = 0; i < this.byteLength; i++) {
-      bytes.push(this.buffer[this.byteOffset + i].toString(16).padStart(2, '0'))
+  [util.inspect.custom]()         {
+    const MAX_BYTES = 32
+    const len = this.byteLength
+    const shown = len < MAX_BYTES ? len : MAX_BYTES
+
+    let hex = ''
+    for (let i = 0; i < shown; i++) {
+      if (i !== 0) {
+        hex += ' '
+      }
+      hex += this.buffer[this.byteOffset + i].toString(16).padStart(2, '0')
     }
-    return `Slice: "${this.toString()}" <${bytes.join(' ')}>`
+    if (shown < len) {
+      hex += ` ... (${len - shown} more)`
+    }
+
+    const strEnd = shown < len ? this.byteOffset + shown : this.byteOffset + len
+    const str = this.buffer.toString('utf8', this.byteOffset, strEnd)
+    const truncated = shown < len ? '…' : ''
+
+    return `Slice(${len}): "${str}${truncated}" <${hex}>`
   }
@@ -272,4 +333,28 @@ }
 
-  constructor(poolTotal = 128 * 1024 * 1024) {
-    this.#poolBuffer = Buffer.allocUnsafe(Number.isFinite(poolTotal) ? poolTotal : 0)
+  constructor(
+    poolTotalOrBuffer                                                                      = 128 *
+      1024 *
+      1024,
+  ) {
+    if (typeof poolTotalOrBuffer === 'number') {
+      this.#poolBuffer = Buffer.allocUnsafeSlow(poolTotalOrBuffer)
+    } else if (poolTotalOrBuffer instanceof Buffer) {
+      this.#poolBuffer = poolTotalOrBuffer
+    } else if (ArrayBuffer.isView(poolTotalOrBuffer)) {
+      this.#poolBuffer = Buffer.from(
+        poolTotalOrBuffer.buffer,
+        poolTotalOrBuffer.byteOffset,
+        poolTotalOrBuffer.byteLength,
+      )
+    } else if (
+      poolTotalOrBuffer instanceof ArrayBuffer ||
+      poolTotalOrBuffer instanceof SharedArrayBuffer
+    ) {
+      this.#poolBuffer = Buffer.from(poolTotalOrBuffer)
+    } else {
+      throw new TypeError(
+        'Invalid poolTotalOrBuffer: must be a Buffer, ArrayBufferView, ArrayBuffer, SharedArrayBuffer, or number',
+      )
+    }
+
     for (let n = 0; 2 ** n <= 256 * 1024; n++) {
@@ -301,5 +386,9 @@ this.#poolsBucket.push([])
 
-    if (slice == null) {
-      slice = new Slice()
-    } else if (slice.byteLength === byteLength) {
+    // 2^30 is the largest power-of-two that fits a 32-bit signed int; a
+    // larger request overflows `1 << dstIdx` to a negative bucket size.
+    if (byteLength > 1 << 30) {
+      throw new RangeError(`byteLength too large: ${byteLength} (max ${1 << 30})`)
+    }
+
+    if (slice.byteLength === byteLength) {
       return slice
@@ -340,11 +429,4 @@ }
     const maxByteLength = 1 << dstIdx
-    if (
-      this.#poolsBucket.length > 32 ||
-      maxByteLength < byteLength ||
-      (maxByteLength & 0x7) !== 0
-    ) {
-      throw new Error(`Invalid pool state`)
-    }
 
-    if (dstIdx < this.#poolsBucket.length && this.#poolsBucket[dstIdx]?.length) {
+    if (dstIdx < this.#poolsBucket.length && this.#poolsBucket[dstIdx].length) {
       slice.buffer = this.#poolBuffer
@@ -351,0 +433,0 @@ slice.byteOffset = this.#poolsBucket[dstIdx].pop()

package.json

 {
   "name": "@nxtedition/slice",
-  "version": "1.1.4",
+  "version": "1.1.5",
   "type": "module",
@@ -33,3 +33,3 @@ "main": "lib/index.js",
   },
-  "gitHead": "a29e479679bd053fa37ff8868d47918a8983ee48"
+  "gitHead": "b3ff34d7bea69e295919bdfdae8bc2e6ff9ab0ff"
 }

Fixed alerts

New author

Supply chain risk

A new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.

Improved metrics

Total package byte prevSize

23603

10.39%

Lines of code

426

18.99%

Number of medium supply chain risk alerts

0

-100%

No dependency changes