admin: updated dist files

CHANGELOG.md

@@ -3,6 +3,11 @@ Change Log
 
 This change log is maintained by `src.ts/_admin/update-changelog.ts` but may also be manually updated.
 
+ethers/v6.10.0 (2024-01-12 19:46)
+---------------------------------
+
+  - Limit decoded result imflation ratio from ABI-encoded data ([#4537](https://github.com/ethers-io/ethers.js/issues/4537); [1b4debd](https://github.com/ethers-io/ethers.js/commit/1b4debd4a9e61d171bfc60590116facb8bdbd2da)).
+
 ethers/v6.9.2 (2024-01-02 19:12)
 --------------------------------
 

dist/ethers.js

@@ -3,7 +3,7 @@ const __$G = (typeof globalThis !== 'undefined' ? globalThis: typeof window !==
 /**
  *  The current version of Ethers.
  */
-const version = "6.9.2";
+const version = "6.10.0";
 
 /**
  *  Property helper functions.
@@ -2970,15 +2970,35 @@ class Reader {
     allowLoose;
     #data;
     #offset;
-    constructor(data, allowLoose) {
+    #bytesRead;
+    #parent;
+    #maxInflation;
+    constructor(data, allowLoose, maxInflation) {
         defineProperties(this, { allowLoose: !!allowLoose });
         this.#data = getBytesCopy(data);
+        this.#bytesRead = 0;
+        this.#parent = null;
+        this.#maxInflation = (maxInflation != null) ? maxInflation : 1024;
         this.#offset = 0;
     }
     get data() { return hexlify(this.#data); }
     get dataLength() { return this.#data.length; }
     get consumed() { return this.#offset; }
     get bytes() { return new Uint8Array(this.#data); }
+    #incrementBytesRead(count) {
+        if (this.#parent) {
+            return this.#parent.#incrementBytesRead(count);
+        }
+        this.#bytesRead += count;
+        // Check for excessive inflation (see: #4537)
+        assert(this.#maxInflation < 1 || this.#bytesRead <= this.#maxInflation * this.dataLength, `compressed ABI data exceeds inflation ratio of ${this.#maxInflation} ( see: https:/\/github.com/ethers-io/ethers.js/issues/4537 )`, "BUFFER_OVERRUN", {
+            buffer: getBytesCopy(this.#data), offset: this.#offset,
+            length: count, info: {
+                bytesRead: this.#bytesRead,
+                dataLength: this.dataLength
+            }
+        });
+    }
     #peekBytes(offset, length, loose) {
         let alignedLength = Math.ceil(length / WordSize) * WordSize;
         if (this.#offset + alignedLength > this.#data.length) {
@@ -2997,11 +3017,14 @@ class Reader {
     }
     // Create a sub-reader with the same underlying data, but offset
     subReader(offset) {
-        return new Reader(this.#data.slice(this.#offset + offset), this.allowLoose);
+        const reader = new Reader(this.#data.slice(this.#offset + offset), this.allowLoose, this.#maxInflation);
+        reader.#parent = this;
+        return reader;
     }
     // Read bytes
     readBytes(length, loose) {
         let bytes = this.#peekBytes(0, length, !!loose);
+        this.#incrementBytesRead(length);
         this.#offset += bytes.length;
         // @TODO: Make sure the length..end bytes are all 0?
         return bytes.slice(0, length);
@@ -12232,6 +12255,7 @@ PanicReasons$1.set(0x51, "UNINITIALIZED_FUNCTION_CALL");
 const paramTypeBytes = new RegExp(/^bytes([0-9]*)$/);
 const paramTypeNumber = new RegExp(/^(u?int)([0-9]*)$/);
 let defaultCoder = null;
+let defaultMaxInflation = 1024;
 function getBuiltinCallException(action, tx, data, abiCoder) {
     let message = "missing revert data";
     let reason = null;
@@ -12368,7 +12392,11 @@ class AbiCoder {
     decode(types, data, loose) {
         const coders = types.map((type) => this.#getCoder(ParamType.from(type)));
         const coder = new TupleCoder(coders, "_");
-        return coder.decode(new Reader(data, loose));
+        return coder.decode(new Reader(data, loose, defaultMaxInflation));
+    }
+    static _setDefaultMaxInflation(value) {
+        assertArgument(typeof (value) === "number" && Number.isInteger(value), "invalid defaultMaxInflation factor", "value", value);
+        defaultMaxInflation = value;
     }
     /**
      *  Returns the shared singleton instance of a default [[AbiCoder]].

dist/ethers.umd.js

@@ -9,7 +9,7 @@ const __$G = (typeof globalThis !== 'undefined' ? globalThis: typeof window !==
     /**
      *  The current version of Ethers.
      */
-    const version = "6.9.2";
+    const version = "6.10.0";
 
     /**
      *  Property helper functions.
@@ -2976,15 +2976,35 @@ const __$G = (typeof globalThis !== 'undefined' ? globalThis: typeof window !==
         allowLoose;
         #data;
         #offset;
-        constructor(data, allowLoose) {
+        #bytesRead;
+        #parent;
+        #maxInflation;
+        constructor(data, allowLoose, maxInflation) {
             defineProperties(this, { allowLoose: !!allowLoose });
             this.#data = getBytesCopy(data);
+            this.#bytesRead = 0;
+            this.#parent = null;
+            this.#maxInflation = (maxInflation != null) ? maxInflation : 1024;
             this.#offset = 0;
         }
         get data() { return hexlify(this.#data); }
         get dataLength() { return this.#data.length; }
         get consumed() { return this.#offset; }
         get bytes() { return new Uint8Array(this.#data); }
+        #incrementBytesRead(count) {
+            if (this.#parent) {
+                return this.#parent.#incrementBytesRead(count);
+            }
+            this.#bytesRead += count;
+            // Check for excessive inflation (see: #4537)
+            assert(this.#maxInflation < 1 || this.#bytesRead <= this.#maxInflation * this.dataLength, `compressed ABI data exceeds inflation ratio of ${this.#maxInflation} ( see: https:/\/github.com/ethers-io/ethers.js/issues/4537 )`, "BUFFER_OVERRUN", {
+                buffer: getBytesCopy(this.#data), offset: this.#offset,
+                length: count, info: {
+                    bytesRead: this.#bytesRead,
+                    dataLength: this.dataLength
+                }
+            });
+        }
         #peekBytes(offset, length, loose) {
             let alignedLength = Math.ceil(length / WordSize) * WordSize;
             if (this.#offset + alignedLength > this.#data.length) {
@@ -3003,11 +3023,14 @@ const __$G = (typeof globalThis !== 'undefined' ? globalThis: typeof window !==
         }
         // Create a sub-reader with the same underlying data, but offset
         subReader(offset) {
-            return new Reader(this.#data.slice(this.#offset + offset), this.allowLoose);
+            const reader = new Reader(this.#data.slice(this.#offset + offset), this.allowLoose, this.#maxInflation);
+            reader.#parent = this;
+            return reader;
         }
         // Read bytes
         readBytes(length, loose) {
             let bytes = this.#peekBytes(0, length, !!loose);
+            this.#incrementBytesRead(length);
             this.#offset += bytes.length;
             // @TODO: Make sure the length..end bytes are all 0?
             return bytes.slice(0, length);
@@ -12238,6 +12261,7 @@ const __$G = (typeof globalThis !== 'undefined' ? globalThis: typeof window !==
     const paramTypeBytes = new RegExp(/^bytes([0-9]*)$/);
     const paramTypeNumber = new RegExp(/^(u?int)([0-9]*)$/);
     let defaultCoder = null;
+    let defaultMaxInflation = 1024;
     function getBuiltinCallException(action, tx, data, abiCoder) {
         let message = "missing revert data";
         let reason = null;
@@ -12374,7 +12398,11 @@ const __$G = (typeof globalThis !== 'undefined' ? globalThis: typeof window !==
         decode(types, data, loose) {
             const coders = types.map((type) => this.#getCoder(ParamType.from(type)));
             const coder = new TupleCoder(coders, "_");
-            return coder.decode(new Reader(data, loose));
+            return coder.decode(new Reader(data, loose, defaultMaxInflation));
+        }
+        static _setDefaultMaxInflation(value) {
+            assertArgument(typeof (value) === "number" && Number.isInteger(value), "invalid defaultMaxInflation factor", "value", value);
+            defaultMaxInflation = value;
         }
         /**
          *  Returns the shared singleton instance of a default [[AbiCoder]].

dist/wordlists-extra.js

@@ -100,7 +100,7 @@ const rotlBL = (h, l, s) => (h << (s - 32)) | (l >>> (64 - s));
 /**
  *  The current version of Ethers.
  */
-const version = "6.9.2";
+const version = "6.10.0";
 
 /**
  *  Property helper functions.

lib.commonjs/_version.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"_version.d.ts","sourceRoot":"","sources":["../src.ts/_version.ts"],"names":[],"mappings":"AAEA;;GAEG;AACH,eAAO,MAAM,OAAO,EAAE,MAAgB,CAAC"}
+{"version":3,"file":"_version.d.ts","sourceRoot":"","sources":["../src.ts/_version.ts"],"names":[],"mappings":"AAEA;;GAEG;AACH,eAAO,MAAM,OAAO,EAAE,MAAiB,CAAC"}

lib.commonjs/_version.js

@@ -5,5 +5,5 @@ exports.version = void 0;
 /**
  *  The current version of Ethers.
  */
-exports.version = "6.9.2";
+exports.version = "6.10.0";
 //# sourceMappingURL=_version.js.map

lib.commonjs/_version.js.map

@@ -1 +1 @@
-{"version":3,"file":"_version.js","sourceRoot":"","sources":["../src.ts/_version.ts"],"names":[],"mappings":";AAAA,mEAAmE;;;AAEnE;;GAEG;AACU,QAAA,OAAO,GAAW,OAAO,CAAC"}
+{"version":3,"file":"_version.js","sourceRoot":"","sources":["../src.ts/_version.ts"],"names":[],"mappings":";AAAA,mEAAmE;;;AAEnE;;GAEG;AACU,QAAA,OAAO,GAAW,QAAQ,CAAC"}

lib.commonjs/abi/abi-coder.d.ts

@@ -40,6 +40,7 @@ export declare class AbiCoder {
      *  padded event data emitted from ``external`` functions.
      */
     decode(types: ReadonlyArray<string | ParamType>, data: BytesLike, loose?: boolean): Result;
+    static _setDefaultMaxInflation(value: number): void;
     /**
      *  Returns the shared singleton instance of a default [[AbiCoder]].
      *

lib.commonjs/abi/abi-coder.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"abi-coder.d.ts","sourceRoot":"","sources":["../../src.ts/abi/abi-coder.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAMH,OAAO,EAAiB,MAAM,EAAU,MAAM,4BAA4B,CAAC;AAU3E,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAK3C,OAAO,KAAK,EACR,SAAS,EACT,mBAAmB,EAAE,kBAAkB,EAC1C,MAAM,mBAAmB,CAAC;AAuF3B;;;GAGG;AACH,qBAAa,QAAQ;;IA4CjB;;;;;OAKG;IACH,eAAe,CAAC,KAAK,EAAE,aAAa,CAAC,MAAM,GAAG,SAAS,CAAC,GAAG,MAAM;IAMjE;;;;OAIG;IACH,MAAM,CAAC,KAAK,EAAE,aAAa,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,MAAM,EAAE,aAAa,CAAC,GAAG,CAAC,GAAG,MAAM;IAWpF;;;;;;OAMG;IACH,MAAM,CAAC,KAAK,EAAE,aAAa,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,EAAE,OAAO,GAAG,MAAM;IAM1F;;;;OAIG;IACH,MAAM,CAAC,eAAe,IAAI,QAAQ;IAOlC;;;;OAIG;IACH,MAAM,CAAC,uBAAuB,CAAC,MAAM,EAAE,mBAAmB,EAAE,EAAE,EAAE;QAAE,EAAE,CAAC,EAAE,IAAI,GAAG,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,IAAI,GAAG,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,IAAI,EAAE,IAAI,GAAG,SAAS,GAAG,kBAAkB;CAG3K"}
+{"version":3,"file":"abi-coder.d.ts","sourceRoot":"","sources":["../../src.ts/abi/abi-coder.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAMH,OAAO,EAAiB,MAAM,EAAU,MAAM,4BAA4B,CAAC;AAU3E,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAK3C,OAAO,KAAK,EACR,SAAS,EACT,mBAAmB,EAAE,kBAAkB,EAC1C,MAAM,mBAAmB,CAAC;AAuF3B;;;GAGG;AACH,qBAAa,QAAQ;;IA4CjB;;;;;OAKG;IACH,eAAe,CAAC,KAAK,EAAE,aAAa,CAAC,MAAM,GAAG,SAAS,CAAC,GAAG,MAAM;IAMjE;;;;OAIG;IACH,MAAM,CAAC,KAAK,EAAE,aAAa,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,MAAM,EAAE,aAAa,CAAC,GAAG,CAAC,GAAG,MAAM;IAWpF;;;;;;OAMG;IACH,MAAM,CAAC,KAAK,EAAE,aAAa,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,EAAE,OAAO,GAAG,MAAM;IAM1F,MAAM,CAAC,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAKnD;;;;OAIG;IACH,MAAM,CAAC,eAAe,IAAI,QAAQ;IAOlC;;;;OAIG;IACH,MAAM,CAAC,uBAAuB,CAAC,MAAM,EAAE,mBAAmB,EAAE,EAAE,EAAE;QAAE,EAAE,CAAC,EAAE,IAAI,GAAG,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,IAAI,GAAG,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,IAAI,EAAE,IAAI,GAAG,SAAS,GAAG,kBAAkB;CAG3K"}

lib.commonjs/abi/abi-coder.js

@@ -43,6 +43,7 @@ PanicReasons.set(0x51, "UNINITIALIZED_FUNCTION_CALL");
 const paramTypeBytes = new RegExp(/^bytes([0-9]*)$/);
 const paramTypeNumber = new RegExp(/^(u?int)([0-9]*)$/);
 let defaultCoder = null;
+let defaultMaxInflation = 1024;
 function getBuiltinCallException(action, tx, data, abiCoder) {
     let message = "missing revert data";
     let reason = null;
@@ -179,7 +180,11 @@ class AbiCoder {
     decode(types, data, loose) {
         const coders = types.map((type) => this.#getCoder(fragments_js_1.ParamType.from(type)));
         const coder = new tuple_js_1.TupleCoder(coders, "_");
-        return coder.decode(new abstract_coder_js_1.Reader(data, loose));
+        return coder.decode(new abstract_coder_js_1.Reader(data, loose, defaultMaxInflation));
+    }
+    static _setDefaultMaxInflation(value) {
+        (0, index_js_1.assertArgument)(typeof (value) === "number" && Number.isInteger(value), "invalid defaultMaxInflation factor", "value", value);
+        defaultMaxInflation = value;
     }
     /**
      *  Returns the shared singleton instance of a default [[AbiCoder]].

lib.commonjs/abi/coders/abstract-coder.d.ts

@@ -108,7 +108,7 @@ export declare class Writer {
 export declare class Reader {
     #private;
     readonly allowLoose: boolean;
-    constructor(data: BytesLike, allowLoose?: boolean);
+    constructor(data: BytesLike, allowLoose?: boolean, maxInflation?: number);
     get data(): string;
     get dataLength(): number;
     get consumed(): number;

lib.commonjs/abi/coders/abstract-coder.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"abstract-coder.d.ts","sourceRoot":"","sources":["../../../src.ts/abi/coders/abstract-coder.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAEpE;;GAEG;AACH,eAAO,MAAM,QAAQ,EAAE,MAAW,CAAC;AAenC;;;;;;GAMG;AACH,qBAAa,MAAO,SAAQ,KAAK,CAAC,GAAG,CAAC;;IAGlC,CAAE,CAAC,EAAE,MAAM,GAAG,MAAM,GAAI,GAAG,CAAA;IAE3B;;OAEG;gBACS,GAAG,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC;IAyF/B;;;;;OAKG;IACH,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC;IASrB;;;;;OAKG;IACH,QAAQ,IAAI,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC;IAe/B;;OAEG;IACH,KAAK,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM;IAuBnE;;OAEG;IACH,MAAM,CAAC,QAAQ,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,EAAE,OAAO,CAAC,EAAE,GAAG,GAAG,MAAM;IAiB3F;;OAEG;IACH,GAAG,CAAC,CAAC,SAAS,GAAG,GAAG,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,CAAC,EAAE,OAAO,CAAC,EAAE,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC;IAezG;;;;;;;OAOG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG;IAa3B;;;OAGG;IACH,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,EAAE,KAAK,CAAC,IAAI,GAAG,MAAM,CAAC,GAAG,MAAM;CAG3E;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,KAAK,CAAC;IAAE,IAAI,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC;IAAC,KAAK,EAAE,KAAK,CAAA;CAAE,CAAC,CAqBvG;AAeD;;GAEG;AACH,8BAAsB,KAAK;IAIvB,QAAQ,CAAC,IAAI,EAAG,MAAM,CAAC;IAIvB,QAAQ,CAAC,IAAI,EAAG,MAAM,CAAC;IAIvB,QAAQ,CAAC,SAAS,EAAG,MAAM,CAAC;IAK5B,QAAQ,CAAC,OAAO,EAAG,OAAO,CAAC;gBAEf,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO;IAM3E,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,GAAG,KAAK;IAI/C,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,GAAG,MAAM;IACnD,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,GAAG;IAEpC,QAAQ,CAAC,YAAY,IAAI,GAAG;CAC/B;AAED;;GAEG;AACH,qBAAa,MAAM;;;IAUf,IAAI,IAAI,IAAI,MAAM,CAEjB;IACD,IAAI,MAAM,IAAI,MAAM,CAA6B;IAQjD,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM;IAKpC,UAAU,CAAC,KAAK,EAAE,SAAS,GAAG,MAAM;IAUpC,UAAU,CAAC,KAAK,EAAE,YAAY,GAAG,MAAM;IAMvC,mBAAmB,IAAI,CAAC,KAAK,EAAE,YAAY,KAAK,IAAI;CAQvD;AAED;;GAEG;AACH,qBAAa,MAAM;;IAKf,QAAQ,CAAC,UAAU,EAAG,OAAO,CAAC;gBAKlB,IAAI,EAAE,SAAS,EAAE,UAAU,CAAC,EAAE,OAAO;IAQjD,IAAI,IAAI,IAAI,MAAM,CAAgC;IAClD,IAAI,UAAU,IAAI,MAAM,CAA8B;IACtD,IAAI,QAAQ,IAAI,MAAM,CAAyB;IAC/C,IAAI,KAAK,IAAI,UAAU,CAAuC;IAmB9D,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM;IAKjC,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,GAAG,UAAU;IAQtD,SAAS,IAAI,MAAM;IAInB,SAAS,IAAI,MAAM;CAGtB"}
+{"version":3,"file":"abstract-coder.d.ts","sourceRoot":"","sources":["../../../src.ts/abi/coders/abstract-coder.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAEpE;;GAEG;AACH,eAAO,MAAM,QAAQ,EAAE,MAAW,CAAC;AAenC;;;;;;GAMG;AACH,qBAAa,MAAO,SAAQ,KAAK,CAAC,GAAG,CAAC;;IAGlC,CAAE,CAAC,EAAE,MAAM,GAAG,MAAM,GAAI,GAAG,CAAA;IAE3B;;OAEG;gBACS,GAAG,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC;IAyF/B;;;;;OAKG;IACH,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC;IASrB;;;;;OAKG;IACH,QAAQ,IAAI,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC;IAe/B;;OAEG;IACH,KAAK,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM;IAuBnE;;OAEG;IACH,MAAM,CAAC,QAAQ,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,EAAE,OAAO,CAAC,EAAE,GAAG,GAAG,MAAM;IAiB3F;;OAEG;IACH,GAAG,CAAC,CAAC,SAAS,GAAG,GAAG,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,CAAC,EAAE,OAAO,CAAC,EAAE,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC;IAezG;;;;;;;OAOG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG;IAa3B;;;OAGG;IACH,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,EAAE,KAAK,CAAC,IAAI,GAAG,MAAM,CAAC,GAAG,MAAM;CAG3E;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,KAAK,CAAC;IAAE,IAAI,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC;IAAC,KAAK,EAAE,KAAK,CAAA;CAAE,CAAC,CAqBvG;AAeD;;GAEG;AACH,8BAAsB,KAAK;IAIvB,QAAQ,CAAC,IAAI,EAAG,MAAM,CAAC;IAIvB,QAAQ,CAAC,IAAI,EAAG,MAAM,CAAC;IAIvB,QAAQ,CAAC,SAAS,EAAG,MAAM,CAAC;IAK5B,QAAQ,CAAC,OAAO,EAAG,OAAO,CAAC;gBAEf,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO;IAM3E,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,GAAG,KAAK;IAI/C,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,GAAG,MAAM;IACnD,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,GAAG;IAEpC,QAAQ,CAAC,YAAY,IAAI,GAAG;CAC/B;AAED;;GAEG;AACH,qBAAa,MAAM;;;IAUf,IAAI,IAAI,IAAI,MAAM,CAEjB;IACD,IAAI,MAAM,IAAI,MAAM,CAA6B;IAQjD,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM;IAKpC,UAAU,CAAC,KAAK,EAAE,SAAS,GAAG,MAAM;IAUpC,UAAU,CAAC,KAAK,EAAE,YAAY,GAAG,MAAM;IAMvC,mBAAmB,IAAI,CAAC,KAAK,EAAE,YAAY,KAAK,IAAI;CAQvD;AAED;;GAEG;AACH,qBAAa,MAAM;;IAKf,QAAQ,CAAC,UAAU,EAAG,OAAO,CAAC;gBASlB,IAAI,EAAE,SAAS,EAAE,UAAU,CAAC,EAAE,OAAO,EAAE,YAAY,CAAC,EAAE,MAAM;IAWxE,IAAI,IAAI,IAAI,MAAM,CAAgC;IAClD,IAAI,UAAU,IAAI,MAAM,CAA8B;IACtD,IAAI,QAAQ,IAAI,MAAM,CAAyB;IAC/C,IAAI,KAAK,IAAI,UAAU,CAAuC;IAkC9D,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM;IAOjC,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,GAAG,UAAU;IAStD,SAAS,IAAI,MAAM;IAInB,SAAS,IAAI,MAAM;CAGtB"}

lib.commonjs/abi/coders/abstract-coder.js

@@ -359,15 +359,35 @@ class Reader {
     allowLoose;
     #data;
     #offset;
-    constructor(data, allowLoose) {
+    #bytesRead;
+    #parent;
+    #maxInflation;
+    constructor(data, allowLoose, maxInflation) {
         (0, index_js_1.defineProperties)(this, { allowLoose: !!allowLoose });
         this.#data = (0, index_js_1.getBytesCopy)(data);
+        this.#bytesRead = 0;
+        this.#parent = null;
+        this.#maxInflation = (maxInflation != null) ? maxInflation : 1024;
         this.#offset = 0;
     }
     get data() { return (0, index_js_1.hexlify)(this.#data); }
     get dataLength() { return this.#data.length; }
     get consumed() { return this.#offset; }
     get bytes() { return new Uint8Array(this.#data); }
+    #incrementBytesRead(count) {
+        if (this.#parent) {
+            return this.#parent.#incrementBytesRead(count);
+        }
+        this.#bytesRead += count;
+        // Check for excessive inflation (see: #4537)
+        (0, index_js_1.assert)(this.#maxInflation < 1 || this.#bytesRead <= this.#maxInflation * this.dataLength, `compressed ABI data exceeds inflation ratio of ${this.#maxInflation} ( see: https:/\/github.com/ethers-io/ethers.js/issues/4537 )`, "BUFFER_OVERRUN", {
+            buffer: (0, index_js_1.getBytesCopy)(this.#data), offset: this.#offset,
+            length: count, info: {
+                bytesRead: this.#bytesRead,
+                dataLength: this.dataLength
+            }
+        });
+    }
     #peekBytes(offset, length, loose) {
         let alignedLength = Math.ceil(length / exports.WordSize) * exports.WordSize;
         if (this.#offset + alignedLength > this.#data.length) {
@@ -386,11 +406,14 @@ class Reader {
     }
     // Create a sub-reader with the same underlying data, but offset
     subReader(offset) {
-        return new Reader(this.#data.slice(this.#offset + offset), this.allowLoose);
+        const reader = new Reader(this.#data.slice(this.#offset + offset), this.allowLoose, this.#maxInflation);
+        reader.#parent = this;
+        return reader;
     }
     // Read bytes
     readBytes(length, loose) {
         let bytes = this.#peekBytes(0, length, !!loose);
+        this.#incrementBytesRead(length);
         this.#offset += bytes.length;
         // @TODO: Make sure the length..end bytes are all 0?
         return bytes.slice(0, length);

lib.esm/_version.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"_version.d.ts","sourceRoot":"","sources":["../src.ts/_version.ts"],"names":[],"mappings":"AAEA;;GAEG;AACH,eAAO,MAAM,OAAO,EAAE,MAAgB,CAAC"}
+{"version":3,"file":"_version.d.ts","sourceRoot":"","sources":["../src.ts/_version.ts"],"names":[],"mappings":"AAEA;;GAEG;AACH,eAAO,MAAM,OAAO,EAAE,MAAiB,CAAC"}

lib.esm/_version.js

@@ -2,5 +2,5 @@
 /**
  *  The current version of Ethers.
  */
-export const version = "6.9.2";
+export const version = "6.10.0";
 //# sourceMappingURL=_version.js.map

lib.esm/_version.js.map

@@ -1 +1 @@
-{"version":3,"file":"_version.js","sourceRoot":"","sources":["../src.ts/_version.ts"],"names":[],"mappings":"AAAA,mEAAmE;AAEnE;;GAEG;AACH,MAAM,CAAC,MAAM,OAAO,GAAW,OAAO,CAAC"}
+{"version":3,"file":"_version.js","sourceRoot":"","sources":["../src.ts/_version.ts"],"names":[],"mappings":"AAAA,mEAAmE;AAEnE;;GAEG;AACH,MAAM,CAAC,MAAM,OAAO,GAAW,QAAQ,CAAC"}

lib.esm/abi/abi-coder.d.ts

@@ -40,6 +40,7 @@ export declare class AbiCoder {
      *  padded event data emitted from ``external`` functions.
      */
     decode(types: ReadonlyArray<string | ParamType>, data: BytesLike, loose?: boolean): Result;
+    static _setDefaultMaxInflation(value: number): void;
     /**
      *  Returns the shared singleton instance of a default [[AbiCoder]].
      *

lib.esm/abi/abi-coder.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"abi-coder.d.ts","sourceRoot":"","sources":["../../src.ts/abi/abi-coder.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAMH,OAAO,EAAiB,MAAM,EAAU,MAAM,4BAA4B,CAAC;AAU3E,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAK3C,OAAO,KAAK,EACR,SAAS,EACT,mBAAmB,EAAE,kBAAkB,EAC1C,MAAM,mBAAmB,CAAC;AAuF3B;;;GAGG;AACH,qBAAa,QAAQ;;IA4CjB;;;;;OAKG;IACH,eAAe,CAAC,KAAK,EAAE,aAAa,CAAC,MAAM,GAAG,SAAS,CAAC,GAAG,MAAM;IAMjE;;;;OAIG;IACH,MAAM,CAAC,KAAK,EAAE,aAAa,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,MAAM,EAAE,aAAa,CAAC,GAAG,CAAC,GAAG,MAAM;IAWpF;;;;;;OAMG;IACH,MAAM,CAAC,KAAK,EAAE,aAAa,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,EAAE,OAAO,GAAG,MAAM;IAM1F;;;;OAIG;IACH,MAAM,CAAC,eAAe,IAAI,QAAQ;IAOlC;;;;OAIG;IACH,MAAM,CAAC,uBAAuB,CAAC,MAAM,EAAE,mBAAmB,EAAE,EAAE,EAAE;QAAE,EAAE,CAAC,EAAE,IAAI,GAAG,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,IAAI,GAAG,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,IAAI,EAAE,IAAI,GAAG,SAAS,GAAG,kBAAkB;CAG3K"}
+{"version":3,"file":"abi-coder.d.ts","sourceRoot":"","sources":["../../src.ts/abi/abi-coder.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAMH,OAAO,EAAiB,MAAM,EAAU,MAAM,4BAA4B,CAAC;AAU3E,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAK3C,OAAO,KAAK,EACR,SAAS,EACT,mBAAmB,EAAE,kBAAkB,EAC1C,MAAM,mBAAmB,CAAC;AAuF3B;;;GAGG;AACH,qBAAa,QAAQ;;IA4CjB;;;;;OAKG;IACH,eAAe,CAAC,KAAK,EAAE,aAAa,CAAC,MAAM,GAAG,SAAS,CAAC,GAAG,MAAM;IAMjE;;;;OAIG;IACH,MAAM,CAAC,KAAK,EAAE,aAAa,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,MAAM,EAAE,aAAa,CAAC,GAAG,CAAC,GAAG,MAAM;IAWpF;;;;;;OAMG;IACH,MAAM,CAAC,KAAK,EAAE,aAAa,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,EAAE,OAAO,GAAG,MAAM;IAM1F,MAAM,CAAC,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAKnD;;;;OAIG;IACH,MAAM,CAAC,eAAe,IAAI,QAAQ;IAOlC;;;;OAIG;IACH,MAAM,CAAC,uBAAuB,CAAC,MAAM,EAAE,mBAAmB,EAAE,EAAE,EAAE;QAAE,EAAE,CAAC,EAAE,IAAI,GAAG,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,IAAI,GAAG,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,IAAI,EAAE,IAAI,GAAG,SAAS,GAAG,kBAAkB;CAG3K"}

lib.esm/abi/abi-coder.js

@@ -40,6 +40,7 @@ PanicReasons.set(0x51, "UNINITIALIZED_FUNCTION_CALL");
 const paramTypeBytes = new RegExp(/^bytes([0-9]*)$/);
 const paramTypeNumber = new RegExp(/^(u?int)([0-9]*)$/);
 let defaultCoder = null;
+let defaultMaxInflation = 1024;
 function getBuiltinCallException(action, tx, data, abiCoder) {
     let message = "missing revert data";
     let reason = null;
@@ -176,7 +177,11 @@ export class AbiCoder {
     decode(types, data, loose) {
         const coders = types.map((type) => this.#getCoder(ParamType.from(type)));
         const coder = new TupleCoder(coders, "_");
-        return coder.decode(new Reader(data, loose));
+        return coder.decode(new Reader(data, loose, defaultMaxInflation));
+    }
+    static _setDefaultMaxInflation(value) {
+        assertArgument(typeof (value) === "number" && Number.isInteger(value), "invalid defaultMaxInflation factor", "value", value);
+        defaultMaxInflation = value;
     }
     /**
      *  Returns the shared singleton instance of a default [[AbiCoder]].

lib.esm/abi/coders/abstract-coder.d.ts

@@ -108,7 +108,7 @@ export declare class Writer {
 export declare class Reader {
     #private;
     readonly allowLoose: boolean;
-    constructor(data: BytesLike, allowLoose?: boolean);
+    constructor(data: BytesLike, allowLoose?: boolean, maxInflation?: number);
     get data(): string;
     get dataLength(): number;
     get consumed(): number;

lib.esm/abi/coders/abstract-coder.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"abstract-coder.d.ts","sourceRoot":"","sources":["../../../src.ts/abi/coders/abstract-coder.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAEpE;;GAEG;AACH,eAAO,MAAM,QAAQ,EAAE,MAAW,CAAC;AAenC;;;;;;GAMG;AACH,qBAAa,MAAO,SAAQ,KAAK,CAAC,GAAG,CAAC;;IAGlC,CAAE,CAAC,EAAE,MAAM,GAAG,MAAM,GAAI,GAAG,CAAA;IAE3B;;OAEG;gBACS,GAAG,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC;IAyF/B;;;;;OAKG;IACH,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC;IASrB;;;;;OAKG;IACH,QAAQ,IAAI,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC;IAe/B;;OAEG;IACH,KAAK,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM;IAuBnE;;OAEG;IACH,MAAM,CAAC,QAAQ,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,EAAE,OAAO,CAAC,EAAE,GAAG,GAAG,MAAM;IAiB3F;;OAEG;IACH,GAAG,CAAC,CAAC,SAAS,GAAG,GAAG,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,CAAC,EAAE,OAAO,CAAC,EAAE,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC;IAezG;;;;;;;OAOG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG;IAa3B;;;OAGG;IACH,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,EAAE,KAAK,CAAC,IAAI,GAAG,MAAM,CAAC,GAAG,MAAM;CAG3E;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,KAAK,CAAC;IAAE,IAAI,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC;IAAC,KAAK,EAAE,KAAK,CAAA;CAAE,CAAC,CAqBvG;AAeD;;GAEG;AACH,8BAAsB,KAAK;IAIvB,QAAQ,CAAC,IAAI,EAAG,MAAM,CAAC;IAIvB,QAAQ,CAAC,IAAI,EAAG,MAAM,CAAC;IAIvB,QAAQ,CAAC,SAAS,EAAG,MAAM,CAAC;IAK5B,QAAQ,CAAC,OAAO,EAAG,OAAO,CAAC;gBAEf,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO;IAM3E,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,GAAG,KAAK;IAI/C,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,GAAG,MAAM;IACnD,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,GAAG;IAEpC,QAAQ,CAAC,YAAY,IAAI,GAAG;CAC/B;AAED;;GAEG;AACH,qBAAa,MAAM;;;IAUf,IAAI,IAAI,IAAI,MAAM,CAEjB;IACD,IAAI,MAAM,IAAI,MAAM,CAA6B;IAQjD,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM;IAKpC,UAAU,CAAC,KAAK,EAAE,SAAS,GAAG,MAAM;IAUpC,UAAU,CAAC,KAAK,EAAE,YAAY,GAAG,MAAM;IAMvC,mBAAmB,IAAI,CAAC,KAAK,EAAE,YAAY,KAAK,IAAI;CAQvD;AAED;;GAEG;AACH,qBAAa,MAAM;;IAKf,QAAQ,CAAC,UAAU,EAAG,OAAO,CAAC;gBAKlB,IAAI,EAAE,SAAS,EAAE,UAAU,CAAC,EAAE,OAAO;IAQjD,IAAI,IAAI,IAAI,MAAM,CAAgC;IAClD,IAAI,UAAU,IAAI,MAAM,CAA8B;IACtD,IAAI,QAAQ,IAAI,MAAM,CAAyB;IAC/C,IAAI,KAAK,IAAI,UAAU,CAAuC;IAmB9D,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM;IAKjC,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,GAAG,UAAU;IAQtD,SAAS,IAAI,MAAM;IAInB,SAAS,IAAI,MAAM;CAGtB"}
+{"version":3,"file":"abstract-coder.d.ts","sourceRoot":"","sources":["../../../src.ts/abi/coders/abstract-coder.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAEpE;;GAEG;AACH,eAAO,MAAM,QAAQ,EAAE,MAAW,CAAC;AAenC;;;;;;GAMG;AACH,qBAAa,MAAO,SAAQ,KAAK,CAAC,GAAG,CAAC;;IAGlC,CAAE,CAAC,EAAE,MAAM,GAAG,MAAM,GAAI,GAAG,CAAA;IAE3B;;OAEG;gBACS,GAAG,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC;IAyF/B;;;;;OAKG;IACH,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC;IASrB;;;;;OAKG;IACH,QAAQ,IAAI,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC;IAe/B;;OAEG;IACH,KAAK,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM;IAuBnE;;OAEG;IACH,MAAM,CAAC,QAAQ,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,EAAE,OAAO,CAAC,EAAE,GAAG,GAAG,MAAM;IAiB3F;;OAEG;IACH,GAAG,CAAC,CAAC,SAAS,GAAG,GAAG,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,CAAC,EAAE,OAAO,CAAC,EAAE,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC;IAezG;;;;;;;OAOG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG;IAa3B;;;OAGG;IACH,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,EAAE,KAAK,CAAC,IAAI,GAAG,MAAM,CAAC,GAAG,MAAM;CAG3E;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,KAAK,CAAC;IAAE,IAAI,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC;IAAC,KAAK,EAAE,KAAK,CAAA;CAAE,CAAC,CAqBvG;AAeD;;GAEG;AACH,8BAAsB,KAAK;IAIvB,QAAQ,CAAC,IAAI,EAAG,MAAM,CAAC;IAIvB,QAAQ,CAAC,IAAI,EAAG,MAAM,CAAC;IAIvB,QAAQ,CAAC,SAAS,EAAG,MAAM,CAAC;IAK5B,QAAQ,CAAC,OAAO,EAAG,OAAO,CAAC;gBAEf,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO;IAM3E,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,GAAG,KAAK;IAI/C,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,GAAG,MAAM;IACnD,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,GAAG;IAEpC,QAAQ,CAAC,YAAY,IAAI,GAAG;CAC/B;AAED;;GAEG;AACH,qBAAa,MAAM;;;IAUf,IAAI,IAAI,IAAI,MAAM,CAEjB;IACD,IAAI,MAAM,IAAI,MAAM,CAA6B;IAQjD,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM;IAKpC,UAAU,CAAC,KAAK,EAAE,SAAS,GAAG,MAAM;IAUpC,UAAU,CAAC,KAAK,EAAE,YAAY,GAAG,MAAM;IAMvC,mBAAmB,IAAI,CAAC,KAAK,EAAE,YAAY,KAAK,IAAI;CAQvD;AAED;;GAEG;AACH,qBAAa,MAAM;;IAKf,QAAQ,CAAC,UAAU,EAAG,OAAO,CAAC;gBASlB,IAAI,EAAE,SAAS,EAAE,UAAU,CAAC,EAAE,OAAO,EAAE,YAAY,CAAC,EAAE,MAAM;IAWxE,IAAI,IAAI,IAAI,MAAM,CAAgC;IAClD,IAAI,UAAU,IAAI,MAAM,CAA8B;IACtD,IAAI,QAAQ,IAAI,MAAM,CAAyB;IAC/C,IAAI,KAAK,IAAI,UAAU,CAAuC;IAkC9D,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM;IAOjC,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,GAAG,UAAU;IAStD,SAAS,IAAI,MAAM;IAInB,SAAS,IAAI,MAAM;CAGtB"}

lib.esm/abi/coders/abstract-coder.js

@@ -352,15 +352,35 @@ export class Reader {
     allowLoose;
     #data;
     #offset;
-    constructor(data, allowLoose) {
+    #bytesRead;
+    #parent;
+    #maxInflation;
+    constructor(data, allowLoose, maxInflation) {
         defineProperties(this, { allowLoose: !!allowLoose });
         this.#data = getBytesCopy(data);
+        this.#bytesRead = 0;
+        this.#parent = null;
+        this.#maxInflation = (maxInflation != null) ? maxInflation : 1024;
         this.#offset = 0;
     }
     get data() { return hexlify(this.#data); }
     get dataLength() { return this.#data.length; }
     get consumed() { return this.#offset; }
     get bytes() { return new Uint8Array(this.#data); }
+    #incrementBytesRead(count) {
+        if (this.#parent) {
+            return this.#parent.#incrementBytesRead(count);
+        }
+        this.#bytesRead += count;
+        // Check for excessive inflation (see: #4537)
+        assert(this.#maxInflation < 1 || this.#bytesRead <= this.#maxInflation * this.dataLength, `compressed ABI data exceeds inflation ratio of ${this.#maxInflation} ( see: https:/\/github.com/ethers-io/ethers.js/issues/4537 )`, "BUFFER_OVERRUN", {
+            buffer: getBytesCopy(this.#data), offset: this.#offset,
+            length: count, info: {
+                bytesRead: this.#bytesRead,
+                dataLength: this.dataLength
+            }
+        });
+    }
     #peekBytes(offset, length, loose) {
         let alignedLength = Math.ceil(length / WordSize) * WordSize;
         if (this.#offset + alignedLength > this.#data.length) {
@@ -379,11 +399,14 @@ export class Reader {
     }
     // Create a sub-reader with the same underlying data, but offset
     subReader(offset) {
-        return new Reader(this.#data.slice(this.#offset + offset), this.allowLoose);
+        const reader = new Reader(this.#data.slice(this.#offset + offset), this.allowLoose, this.#maxInflation);
+        reader.#parent = this;
+        return reader;
     }
     // Read bytes
     readBytes(length, loose) {
         let bytes = this.#peekBytes(0, length, !!loose);
+        this.#incrementBytesRead(length);
         this.#offset += bytes.length;
         // @TODO: Make sure the length..end bytes are all 0?
         return bytes.slice(0, length);

package.json

@@ -93,7 +93,7 @@
       "url": "https://www.buymeacoffee.com/ricmoo"
     }
   ],
-  "gitHead": "ccac24a5b0a4d07a4b639c1c4d0a44703e32d418",
+  "gitHead": "1b4debd4a9e61d171bfc60590116facb8bdbd2da",
   "homepage": "https://ethers.org",
   "keywords": [
     "ethereum",
@@ -131,5 +131,5 @@
     "test-esm": "mocha --trace-warnings --reporter ./reporter.cjs ./lib.esm/_tests/test-*.js"
   },
   "sideEffects": false,
-  "version": "6.9.2"
+  "version": "6.10.0"
 }

src.ts/_version.ts

@@ -3,4 +3,4 @@
 /**
  *  The current version of Ethers.
  */
-export const version: string = "6.9.2";
+export const version: string = "6.10.0";