applesign - npm Package Compare versions

Comparing version 1.7.0 to 1.8.0

depsolver.js

@@ -9,2 +9,4 @@ 'use strict';
 
+const MACH0_MIN_SIZE = 1024 * 4;
+
 function resolveRpath (libs, file, lib) {
@@ -59,26 +61,34 @@ const realLib = lib.substring(6); /* chop @rpath */
   try {
-    const data = fs.readFileSync(file);
-    try {
-      var exec = macho.parse(data);
-    } catch (e) {
+    fs.readFile(file, (err, data) => {
+      if (err) {
+        console.error(err);
+        return cb(err);
+      }
+      if (data.length < MACH0_MIN_SIZE) {
+        return cb(new Error('mach0 files can\'t be that small'));
+      }
       try {
-        var fat = fatmacho.parse(data);
-      } catch (e2) {
-        return cb(e2);
-      }
-      for (let i = 0; i < fat.length; i++) {
+        var exec = macho.parse(data);
+      } catch (e) {
         try {
-          exec = macho.parse(fat[0].data);
-          break;
+          var fat = fatmacho.parse(data);
         } catch (e2) {
-          /* ignore exceptions here */
+          return cb(e2);
         }
+        for (let i = 0; i < fat.length; i++) {
+          try {
+            exec = macho.parse(fat[0].data);
+            break;
+          } catch (e2) {
+            /* ignore exceptions here */
+          }
+        }
       }
-    }
-    const libs = exec.cmds.filter((x) => {
-      return x.type === 'load_dylib' || x.type === 'load_weak_dylib';
-    }).map((x) => {
-      return x.name;
+      const libs = exec.cmds.filter((x) => {
+        return x.type === 'load_dylib' || x.type === 'load_weak_dylib';
+      }).map((x) => {
+        return x.name;
+      });
+      cb(null, libs);
     });
-    cb(null, libs);
   } catch (e) {
@@ -85,0 +95,0 @@ cb(e);

package.json

@@ -67,3 +67,3 @@ {
   "name": "applesign",
-  "version": "1.7.0"
+  "version": "1.8.0"
 }

session.js

@@ -118,2 +118,5 @@ 'use strict';
   ];
+  if (buffer.length < 4) {
+    return false;
+  }
   for (let a of magics) {
@@ -518,6 +521,7 @@ if (!buffer.compare(Buffer.from(a))) {
         const fd = fs.openSync(file, 'r');
-        let buffer = new Buffer(4);
-        fs.readSync(fd, buffer, 0, 4);
-        if (isMacho(buffer)) {
-          libraries.push(file);
+        let buffer = Buffer.alloc(4);
+        if (fs.readSync(fd, buffer, 0, 4) === 4) {
+          if (isMacho(buffer)) {
+            libraries.push(file);
+          }
         }
@@ -524,0 +528,0 @@ fs.close(fd);

No alert changes

Improved metrics

Total package byte prevSize

54021

increased by0.67%

Lines of code

1399

increased by0.94%

No dependency changes