Merge commit from fork

Author: broofa

src/test/v1.test.ts

@@ -204,8 +204,8 @@ describe('v1', () => {
   test('throws RangeError for out-of-range indexes', () => {
     const buf15 = new Uint8Array(15);
     const buf30 = new Uint8Array(30);
-    assert.throws(() => v1({}, buf15));
-    assert.throws(() => v1({}, buf30, -1));
-    assert.throws(() => v1({}, buf30, 15));
+    assert.throws(() => v1({}, buf15), RangeError);
+    assert.throws(() => v1({}, buf30, -1), RangeError);
+    assert.throws(() => v1({}, buf30, 15), RangeError);
   });
 });

src/test/v35.test.ts

@@ -161,6 +161,14 @@ describe('v35', () => {
     assert.throws(() => v3('hello.example.com', null, new Uint8Array(16)));
   });
 
+  test('v3 throws RangeError for out-of-range indexes', () => {
+    const buf15 = new Uint8Array(15);
+    const buf30 = new Uint8Array(30);
+    assert.throws(() => v3('hello.example.com', v3.DNS, buf15), RangeError);
+    assert.throws(() => v3('hello.example.com', v3.DNS, buf30, -1), RangeError);
+    assert.throws(() => v3('hello.example.com', v3.DNS, buf30, 15), RangeError);
+  });
+
   test('v5', () => {
     // Expect to get the same results as http://tools.adjet.org/uuid-v5
     assert.strictEqual(
@@ -269,6 +277,14 @@ describe('v35', () => {
     assert.throws(() => v5('hello.example.com', null, new Uint8Array(16)));
   });
 
+  test('v5 throws RangeError for out-of-range indexes', () => {
+    const buf15 = new Uint8Array(15);
+    const buf30 = new Uint8Array(30);
+    assert.throws(() => v5('hello.example.com', v5.DNS, buf15), RangeError);
+    assert.throws(() => v5('hello.example.com', v5.DNS, buf30, -1), RangeError);
+    assert.throws(() => v5('hello.example.com', v5.DNS, buf30, 15), RangeError);
+  });
+
   test('v3/v5 constants', () => {
     assert.strictEqual(v3.DNS, '6ba7b810-9dad-11d1-80b4-00c04fd430c8');
     assert.strictEqual(v3.URL, '6ba7b811-9dad-11d1-80b4-00c04fd430c8');

src/test/v4.test.ts

@@ -117,8 +117,8 @@ describe('v4', () => {
   test('throws RangeError for out-of-range indexes', () => {
     const buf15 = new Uint8Array(15);
     const buf30 = new Uint8Array(30);
-    assert.throws(() => v4({}, buf15));
-    assert.throws(() => v4({}, buf30, -1));
-    assert.throws(() => v4({}, buf30, 15));
+    assert.throws(() => v4({}, buf15), RangeError);
+    assert.throws(() => v4({}, buf30, -1), RangeError);
+    assert.throws(() => v4({}, buf30, 15), RangeError);
   });
 });

src/test/v6.test.ts

@@ -80,6 +80,14 @@ describe('v6', () => {
     assert.deepEqual(buffer, expectedBuf);
   });
 
+  test('throws RangeError for out-of-range indexes', () => {
+    const buf15 = new Uint8Array(15);
+    const buf30 = new Uint8Array(30);
+    assert.throws(() => v6({}, buf15), RangeError);
+    assert.throws(() => v6({}, buf30, -1), RangeError);
+    assert.throws(() => v6({}, buf30, 15), RangeError);
+  });
+
   test('v1 -> v6 conversion', () => {
     const id = v1ToV6(V1_ID);
     assert.equal(id, V6_ID);

src/test/v7.test.ts

@@ -293,8 +293,8 @@ describe('v7', () => {
   test('throws RangeError for out-of-range indexes', () => {
     const buf15 = new Uint8Array(15);
     const buf30 = new Uint8Array(30);
-    assert.throws(() => v7({}, buf15));
-    assert.throws(() => v7({}, buf30, -1));
-    assert.throws(() => v7({}, buf30, 15));
+    assert.throws(() => v7({}, buf15), RangeError);
+    assert.throws(() => v7({}, buf30, -1), RangeError);
+    assert.throws(() => v7({}, buf30, 15), RangeError);
   });
 });

src/v35.ts

@@ -55,7 +55,12 @@ export default function v35<TBuf extends Uint8Array = Uint8Array>(
   bytes[8] = (bytes[8] & 0x3f) | 0x80;
 
   if (buf) {
-    offset = offset || 0;
+    offset ??= 0;
+    if (offset < 0 || offset + 16 > buf.length) {
+      throw new RangeError(
+        `UUID byte range ${offset}:${offset + 15} is out of buffer bounds`,
+      );
+    }
 
     for (let i = 0; i < 16; ++i) {
       buf[offset + i] = bytes[i];

src/v6.ts

@@ -31,6 +31,12 @@ function v6<TBuf extends Uint8Array = Uint8Array>(
 
   // Return as a byte array if requested
   if (buf) {
+    if (offset < 0 || offset + 16 > buf.length) {
+      throw new RangeError(
+        `UUID byte range ${offset}:${offset + 15} is out of buffer bounds`,
+      );
+    }
+
     for (let i = 0; i < 16; i++) {
       buf[offset + i] = bytes[i];
     }