Doc, lint and version

Author: ChanceBarimbao

CHANGELOG.md

@@ -5,7 +5,8 @@ All notable changes to this project will be documented in this file. The format
 ## Table of Contents
 
 - [Unreleased](#unreleased)
-- [1.9.16 - 2025-12-02](#1916---2025-12-02)
+- [1.9.17 - 2025-12-01](#1917---2025-12-01)
+- [1.9.16 - 2025-12-01](#1916---2025-12-02)
 - [1.9.15 - 2025-12-01](#1915---2025-12-01)
 - [1.9.14 - 2025-12-01](#1914---2025-12-01)
 - [1.9.13 - 2025-12-01](#1913---2025-12-01)
@@ -188,7 +189,7 @@ All notable changes to this project will be documented in this file. The format
 ### Security
 ---
 
-### [1.9.16] - 2025-12-01
+### [1.9.17] - 2025-12-01
 
 ### Added
 

package-lock.json

@@ -4,6 +4,7 @@ import {
   zero2,
   toHex,
   encode,
+  toUTF8,
   fromBase58,
   toBase58,
   fromBase58Check,
@@ -209,6 +210,48 @@ describe('utils', () => {
   })
 })
 
+describe('toUTF8 bounds checks', () => {
+  const guarded = (arr: number[]): number[] => {
+    const target = arr.slice()
+    const handler: ProxyHandler<number[]> = {
+      get (t, prop, receiver) {
+        if (prop === 'length' || typeof prop !== 'string') {
+          return Reflect.get(t, prop as any, receiver)
+        }
+        const idx = Number(prop)
+        if (Number.isInteger(idx)) {
+          if (idx < 0 || idx >= t.length) {
+            throw new Error(`out-of-bounds read at index ${idx} (length ${t.length})`)
+          }
+        }
+        return Reflect.get(t, prop as any, receiver)
+      }
+    }
+    return new Proxy(target, handler) as unknown as number[]
+  }
+
+  it('does not access out-of-bounds on truncated 2-byte sequence', () => {
+    const input = guarded([0xC3])
+    expect(() => toUTF8(input)).not.toThrow()
+  })
+
+  it('does not access out-of-bounds on truncated 3-byte sequences', () => {
+    const input1 = guarded([0xE2])
+    const input2 = guarded([0xE2, 0x82])
+    expect(() => toUTF8(input1)).not.toThrow()
+    expect(() => toUTF8(input2)).not.toThrow()
+  })
+
+  it('does not access out-of-bounds on truncated 4-byte sequences', () => {
+    const input1 = guarded([0xF0])
+    const input2 = guarded([0xF0, 0x9F])
+    const input3 = guarded([0xF0, 0x9F, 0x98])
+    expect(() => toUTF8(input1)).not.toThrow()
+    expect(() => toUTF8(input2)).not.toThrow()
+    expect(() => toUTF8(input3)).not.toThrow()
+  })
+})
+
 describe('toArray base64', () => {
   it('decodes empty string to empty array', () => {
     expect(toArray('', 'base64')).toEqual([])

src/primitives/__tests/utils.test.ts

@@ -237,7 +237,8 @@ export const toUTF8 = (arr: number[]): string => {
 
   for (let i = 0; i < arr.length; i++) {
     const byte = arr[i]
-
+    // this byte is part of a multi-byte sequence, skip it
+    // added to avoid modifying i within the loop which is considered unsafe.
     if (skip > 0) {
       skip--
       continue
@@ -287,6 +288,7 @@ export const toUTF8 = (arr: number[]): string => {
         ((byte3 & 0x3f) << 6) |
         (byte4 & 0x3f)
 
+      // Convert to UTF-16 surrogate pair
       const surrogate1 = 0xd800 + ((codePoint - 0x10000) >> 10)
       const surrogate2 = 0xdc00 + ((codePoint - 0x10000) & 0x3ff)
       result += String.fromCharCode(surrogate1, surrogate2)