diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3c98072..8b1992a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,2 +1,10 @@
+## [3.3.2](https://github.com/Automattic/socket.io-parser/compare/3.3.1...3.3.2) (2021-01-09)
+
+
+### Bug Fixes
+
+* prevent DoS (OOM) via massive packets ([#95](https://github.com/Automattic/socket.io-parser/issues/95)) ([89197a0](https://github.com/Automattic/socket.io-parser/commit/89197a05c43b18cc4569fd178d56e7bb8f403865))
+
+
## [3.3.1](https://github.com/socketio/socket.io-parser/compare/3.3.0...3.3.1) (2020-09-30)
diff --git a/index.js b/index.js
index 102615a..ff613cc 100644
--- a/index.js
+++ b/index.js
@@ -286,11 +286,9 @@ function decodeString(str) {
// look up attachments if type binary
if (exports.BINARY_EVENT === p.type || exports.BINARY_ACK === p.type) {
- var buf = '';
- while (str.charAt(++i) !== '-') {
- buf += str.charAt(i);
- if (i == str.length) break;
- }
+ var start = i + 1;
+ while (str.charAt(++i) !== '-' && i != str.length) {}
+ var buf = str.substring(start, i);
if (buf != Number(buf) || str.charAt(i) !== '-') {
throw new Error('Illegal attachments');
}
@@ -299,13 +297,13 @@ function decodeString(str) {
// look up namespace (if any)
if ('/' === str.charAt(i + 1)) {
- p.nsp = '';
+ var start = i + 1;
while (++i) {
var c = str.charAt(i);
if (',' === c) break;
- p.nsp += c;
if (i === str.length) break;
}
+ p.nsp = str.substring(start, i);
} else {
p.nsp = '/';
}
@@ -313,17 +311,16 @@ function decodeString(str) {
// look up id
var next = str.charAt(i + 1);
if ('' !== next && Number(next) == next) {
- p.id = '';
+ var start = i + 1;
while (++i) {
var c = str.charAt(i);
if (null == c || Number(c) != c) {
--i;
break;
}
- p.id += str.charAt(i);
if (i === str.length) break;
}
- p.id = Number(p.id);
+ p.id = Number(str.substring(start, i + 1));
}
// look up json data
diff --git a/package-lock.json b/package-lock.json
index 6718338..e7cdf10 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,6 +1,6 @@
{
"name": "socket.io-parser",
- "version": "3.3.1",
+ "version": "3.3.2",
"lockfileVersion": 1,
"requires": true,
"dependencies": {
diff --git a/package.json b/package.json
index 3b39d68..70857ad 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
{
"name": "socket.io-parser",
- "version": "3.3.1",
+ "version": "3.3.2",
"description": "socket.io protocol parser",
"repository": {
"type": "git",
pFad - Phonifier reborn
Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.
Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.
Alternative Proxies:
Alternative Proxy
pFad Proxy
pFad v3 Proxy
pFad v4 Proxy