Skip to content

Commit 3101acf

Browse files
fix: Prevent DataView length overflow in getBinaryViewBytes
When reading BinaryView/Utf8View data, ensure the DataView length doesn't exceed available buffer bounds. This fixes 'Invalid DataView length 16' errors that occur when the underlying buffer has less than 16 bytes available at the offset position. Fixes test failures in ES5 UMD build where view data deserialization was failing with RangeError.
1 parent 4c399d0 commit 3101acf

File tree

1 file changed

+8
-3
lines changed

1 file changed

+8
-3
lines changed

src/visitor/get.ts

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -160,14 +160,19 @@ const getBinaryViewBytes = (data: Data<BinaryView | Utf8View>, index: number): U
160160
throw new Error('BinaryView data is missing view buffer');
161161
}
162162
const start = (data.offset + index) * BINARY_VIEW_SIZE;
163-
const baseOffset = values.byteOffset + start;
164-
const view = new DataView(values.buffer, baseOffset, BINARY_VIEW_SIZE);
163+
// Get the 16-byte view struct from the values array
164+
const viewStruct = values.subarray(start, start + BINARY_VIEW_SIZE);
165+
if (viewStruct.length < BINARY_VIEW_SIZE) {
166+
throw new Error(`BinaryView data buffer is too short: expected ${BINARY_VIEW_SIZE} bytes, got ${viewStruct.length}`);
167+
}
168+
const view = new DataView(viewStruct.buffer, viewStruct.byteOffset, BINARY_VIEW_SIZE);
165169
const size = view.getInt32(0, true);
166170
if (size <= 0) {
167171
return new Uint8Array(0);
168172
}
169173
if (size <= BINARY_VIEW_INLINE_CAPACITY) {
170-
return new Uint8Array(values.buffer, baseOffset + 4, size);
174+
// Inline data is in bytes 4-15 of the view struct
175+
return viewStruct.subarray(4, 4 + size);
171176
}
172177
const bufferIndex = view.getInt32(8, true);
173178
const offset = view.getInt32(12, true);

0 commit comments

Comments
 (0)