whatwg/mimesniff

Parse a Vint algorithm is incorrect due to off by one loop.

Closed this issue · 0 comments

What is the issue with the MIME Sniffing Standard?

https://mimesniff.spec.whatwg.org/#parse-a-vint

current text is:

    // 1. Let mask be 128.
    // 2. Let max vint length be 8.
    // 3. Let number size be 1.
    // 4. While number size is less than max vint length, and less than length, continuously loop through these steps:
        // 1. If the sequence[index] & mask is not zero, abort these steps.
        // 2. Let mask be the value of mask >> 1.
        // 3. Increment number size by one.
    // 5. Let index be 0.
    // 6. Let parsed number be sequence[index] & ~mask.
    // 7. Increment index by one.
    // 8. Let bytes remaining be the value of number size.
    // 9. While bytes remaining is not zero, execute there steps:
        // 1. Let parsed number be parsed number << 8.
        // 2. Let parsed number be parsed number | sequence[index].
        // 3. Increment index by one.
        // 3. If index is greater or equal than length, abort these steps.
        // 5. Decrement bytes remaining by one.
    // 10. Return parsed number and number size

This algorithm will always yield an invalid parsed number; step 5, 6, 7 will process the first digit.
step 8 and 9 will process the remaining ones if any.

Step 8. should therefore read:
8. Let bytes remaining be the value of number size - 1
or insert between step 8 and step 9 :
decrement bytes remaining by one.