Pin three untested guards: download timer, URL fragment, short APP1 (closes #89)

The download idle deadline's timer is unref'd so it never holds the process open, and a test checks no timer is left after a download completes or fails. A test covers the rejection of "#" in a request path. The EXIF scan accepts an APP1 segment only when its length is at least 8, since a shorter one cannot hold the six-byte Exif header; tests cover lengths 7 and 8. Model: opus-5-5
2026-09-23 03:44:45 +02:00
parent 28a2beeab8
commit c75c4f987c
5 changed files with 83 additions and 3 deletions
@@ -45,8 +45,11 @@ export const extractExifFromJpeg = (
                error: `segment length ${len} at byte ${offset} runs past the end of the file`,
            };
        if (marker === 0xe1) {
-            // APP1 — check for "Exif\0\0" header
+            // APP1 — check for "Exif\0\0" header. A length under 8 cannot hold
+            // the six-byte header, so the segment is not EXIF; below 6 the
+            // bytes compared would also lie past the segment.
            if (
+                len >= 8 &&
                buf[offset + 4] === 0x45 &&
                buf[offset + 5] === 0x78 &&
                buf[offset + 6] === 0x69 &&