bl - npm Package Compare versions

Comparing version 4.0.2 to 4.0.3

BufferList.js

@@ -137,8 +137,9 @@ 'use strict'
       this._bufs[i].copy(dst, bufoff, start)
+      bufoff += l
     } else {
       this._bufs[i].copy(dst, bufoff, start, start + bytes)
+      bufoff += l
       break
     }
 
-    bufoff += l
     bytes -= l
@@ -151,2 +152,5 @@
 
+  // safeguard so that we don't return uninitialized memory
+  if (dst.length > bufoff) return dst.slice(0, bufoff)
+
   return dst
@@ -193,2 +197,7 @@ }
 BufferList.prototype.consume = function consume (bytes) {
+  // first, normalize the argument, in accordance with how Buffer does it
+  bytes = Math.trunc(bytes)
+  // do nothing if not a positive number
+  if (Number.isNaN(bytes) || bytes <= 0) return this
+
   while (this._bufs.length) {
@@ -195,0 +204,0 @@ if (bytes >= this._bufs[0].length) {

package.json

 {
   "name": "bl",
-  "version": "4.0.2",
+  "version": "4.0.3",
   "description": "Buffer List: collect buffers and access with a standard readable Buffer interface, streamable too!",
+  "license": "MIT",
   "main": "bl.js",
@@ -6,0 +7,0 @@ "scripts": {

test/test.js

@@ -466,2 +466,18 @@ 'use strict'
 
+tape('uninitialized memory', function (t) {
+  const secret = crypto.randomBytes(256)
+  for (let i = 0; i < 1e6; i++) {
+    const clone = Buffer.from(secret)
+    const bl = new BufferList()
+    bl.append(Buffer.from('a'))
+    bl.consume(-1024)
+    const buf = bl.slice(1)
+    if (buf.indexOf(clone) !== -1) {
+      t.fail(`Match (at ${i})`)
+      break
+    }
+  }
+  t.end()
+})
+
 !process.browser && tape('test stream', function (t) {
@@ -468,0 +484,0 @@ const random = crypto.randomBytes(65534)

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

63707

increased by1.15%

Lines of code

1483

increased by1.51%

No dependency changes