doc and lint

Author: ChanceBarimbao

CHANGELOG.md

@@ -5,6 +5,7 @@ All notable changes to this project will be documented in this file. The format
 ## Table of Contents
 
 - [Unreleased](#unreleased)
+- [1.9.16 - 2025-12-02](#1916---2025-12-02)
 - [1.9.15 - 2025-12-01](#1915---2025-12-01)
 - [1.9.14 - 2025-12-01](#1914---2025-12-01)
 - [1.9.13 - 2025-12-01](#1913---2025-12-01)
@@ -185,6 +186,13 @@ All notable changes to this project will be documented in this file. The format
 ### Fixed
 
 ### Security
+---
+
+### [1.9.16] - 2025-12-01
+
+### Added
+
+- Added bound checking in the toUTF8 function to prevent buffer overflows.
 
 ---
 

docs/reference/primitives.md

@@ -6099,32 +6099,39 @@ toUTF8 = (arr: number[]): string => {
         }
         if (byte <= 127) {
             result += String.fromCharCode(byte);
+            continue;
         }
-        else if (byte >= 192 && byte <= 223) {
-            const byte2 = arr[i + 1];
-            skip = 1;
+        if (byte >= 192 && byte <= 223) {
+            const avail = arr.length - (i + 1);
+            const byte2 = avail >= 1 ? arr[i + 1] : 0;
+            skip = Math.min(1, avail);
             const codePoint = ((byte & 31) << 6) | (byte2 & 63);
             result += String.fromCharCode(codePoint);
+            continue;
         }
-        else if (byte >= 224 && byte <= 239) {
-            const byte2 = arr[i + 1];
-            const byte3 = arr[i + 2];
-            skip = 2;
+        if (byte >= 224 && byte <= 239) {
+            const avail = arr.length - (i + 1);
+            const byte2 = avail >= 1 ? arr[i + 1] : 0;
+            const byte3 = avail >= 2 ? arr[i + 2] : 0;
+            skip = Math.min(2, avail);
             const codePoint = ((byte & 15) << 12) | ((byte2 & 63) << 6) | (byte3 & 63);
             result += String.fromCharCode(codePoint);
+            continue;
         }
-        else if (byte >= 240 && byte <= 247) {
-            const byte2 = arr[i + 1];
-            const byte3 = arr[i + 2];
-            const byte4 = arr[i + 3];
-            skip = 3;
+        if (byte >= 240 && byte <= 247) {
+            const avail = arr.length - (i + 1);
+            const byte2 = avail >= 1 ? arr[i + 1] : 0;
+            const byte3 = avail >= 2 ? arr[i + 2] : 0;
+            const byte4 = avail >= 3 ? arr[i + 3] : 0;
+            skip = Math.min(3, avail);
             const codePoint = ((byte & 7) << 18) |
                 ((byte2 & 63) << 12) |
                 ((byte3 & 63) << 6) |
                 (byte4 & 63);
             const surrogate1 = 55296 + ((codePoint - 65536) >> 10);
             const surrogate2 = 56320 + ((codePoint - 65536) & 1023);
             result += String.fromCharCode(surrogate1, surrogate2);
+            continue;
         }
     }
     return result;

src/primitives/utils.ts

@@ -232,7 +232,7 @@ function utf8ToArray (str: string): number[] {
  * @returns {string} - The UTF-8 encoded string.
  */
 export const toUTF8 = (arr: number[]): string => {
-  let result = ""
+  let result = ''
   let skip = 0
 
   for (let i = 0; i < arr.length; i++) {
@@ -292,8 +292,6 @@ export const toUTF8 = (arr: number[]): string => {
       result += String.fromCharCode(surrogate1, surrogate2)
       continue
     }
-
-    // If it's an invalid leading byte, keep prior behavior: do nothing / skip
   }
 
   return result