🐛 Do not read beyond arraybuffer bounds

src/ssn/getSolidpkg.ts

@@ -13,15 +13,12 @@ export default async function getSolidpkg(product: Product, from: number, to: nu
   if (!verifyProductName(product)) {
     throw new TypeError(`"${product}" is not a valid product.`);
   }
-  if (typeof from !== 'number' || (from | 0) !== from || from < -1) {
+  if (typeof from !== 'number' || (from | 0) !== from || from < -1 || from > 999) {
     throw new TypeError(`from must be an integer greater than or equal to -1 but it is "${from}"`);
   }
-  if (typeof to !== 'number' || (to | 0) !== to || to < 0) {
+  if (typeof to !== 'number' || (to | 0) !== to || to < 0 || to > 999) {
     throw new TypeError(`to must be an integer greater than or equal to 0 but it is "${to}"`);
   }
-  if (from >= to) {
-    throw new TypeError(`from must be less than to but "${from}" is not less than "${to}".`);
-  }
 
   //Download .solidpkg file
   const ssnFile = await getUrlContents({ host: 'cdn-patch.swtor.com', path: `/patch/${product}/${product}_${from}to${to}.solidpkg` });

src/ssn/streams/arrayBufferToStream.ts

@@ -4,14 +4,14 @@ const BUFFER_SIZE = 16 * 1024;
 
 export default function arrayBufferToStream(arrayBuffer: ArrayBuffer, offset = 0): stream.Readable {
   if (offset < 0 || offset + 1 >= arrayBuffer.byteLength) {
-    throw new Error('Could not convert ArrayBuffer to ReadableStream; out of bounds.');
+    throw new RangeError('Could not convert ArrayBuffer to ReadableStream; out of bounds.');
   }
 
   let position = offset;
   const outStream = new stream.Readable({
     encoding: 'binary',
     read(size) {
-      const chunkSize = size || BUFFER_SIZE; //TODO: we can probably remove BUFFER_SIZE
+      const chunkSize = Math.min(size || BUFFER_SIZE, arrayBuffer.byteLength - position); //TODO: we can probably remove BUFFER_SIZE
       let needMoreData: boolean;
       do {
         //If end is reached

src/ssn/streams/streamSetMaxLength.ts

@@ -3,7 +3,7 @@ import * as stream from 'stream';
 /** Takes the given ReadableStream and returns a ReadableStream with the same contents but that terminates after the given length. */
 export default function streamSetMaxLength(inputStream: stream.Readable, maxLength: number): stream.Readable {
   if (maxLength <= 0) {
-    throw new Error('maxLength is out of bounds.');
+    throw new RangeError('maxLength is out of bounds.');
   }
 
   let remaining = maxLength;

src/ssn/verify/verifySolidpkg.ts

@@ -53,6 +53,7 @@ export default function verifySolidpkg(file: ISolid, { product, from, to }: {pro
     }
   }
 
+  //64kb, 256kb, 512kb, 4mb
   if (!([0x1_0000, 0x4_0000, 0x8_0000, 0x40_0000]).includes(file.info['piece length'])) {
     throw new Error(`Expected piece length to be "65536", "262144", 524288" or "4194304" but it was "${file.info['piece length']}".`);
   }