mirror of
https://github.com/callstack/agent-device.git
synced 2026-09-14 20:06:34 +08:00
Michał Pierzchała
42dc9adb5d
* fix: address security scanner findings * fix: close image-size parser review gap * test: prove zero-length image box regressions * fix: keep fixture fingerprint output machine-readable * test: align fixture fallback with fingerprint owner
36 lines
1.3 KiB
Diff
36 lines
1.3 KiB
Diff
diff --git a/dist/types/icns.js b/dist/types/icns.js
|
|
index f2bfafef3723cb423b110304815e56e3f97f81e0..1379f55b63656b52913462790bf6393bebd4a4fc 100644
|
|
--- a/dist/types/icns.js
|
|
+++ b/dist/types/icns.js
|
|
@@ -93,6 +93,8 @@ exports.ICNS = {
|
|
while (imageOffset < fileLength && imageOffset < inputLength) {
|
|
imageHeader = readImageHeader(input, imageOffset);
|
|
imageSize = getImageSize(imageHeader[0]);
|
|
+ if (imageHeader[1] < 8)
|
|
+ break;
|
|
imageOffset += imageHeader[1];
|
|
result.images.push(imageSize);
|
|
}
|
|
diff --git a/dist/types/utils.js b/dist/types/utils.js
|
|
index 5224bbafe87551ac415cb3de234820ccc0ff6e2c..2a487ca78ee269aea9c82a00314b0c12646c360c 100644
|
|
--- a/dist/types/utils.js
|
|
+++ b/dist/types/utils.js
|
|
@@ -52,6 +52,8 @@ function readBox(input, offset) {
|
|
if (input.length - offset < 4)
|
|
return;
|
|
const boxSize = (0, exports.readUInt32BE)(input, offset);
|
|
+ if (boxSize < 8)
|
|
+ return;
|
|
if (input.length - offset < boxSize)
|
|
return;
|
|
return {
|
|
@@ -61,7 +63,7 @@ function readBox(input, offset) {
|
|
};
|
|
}
|
|
function findBox(input, boxName, offset) {
|
|
- while (offset < input.length) {
|
|
+ while (offset + 8 <= input.length) {
|
|
const box = readBox(input, offset);
|
|
if (!box)
|
|
break;
|