X-Git-Url: http://git.squeep.com/?p=squeep-mystery-box;a=blobdiff_plain;f=lib%2Fmystery-box.js;h=6198cc816484b406804cf4a4cdd3c84685bce60e;hp=be12245538fd966172e88b5f7266dd0a4d949a45;hb=383899395bf599359d60337edb651af0592f82cb;hpb=6dbf84c8308199dc0ad0e601e0081aafbc72f681

diff --git a/lib/mystery-box.js b/lib/mystery-box.js
index be12245..6198cc8 100644
--- a/lib/mystery-box.js
+++ b/lib/mystery-box.js
@@ -208,6 +208,10 @@ class MysteryBox {
       end: 0,
     };
 
+    if (!box) {
+      throw new RangeError('nothing to unpack');
+    }
+
     const raw = Buffer.from(common.base64URLToBase64(box), 'base64');
     let offset = 0;
 
@@ -219,6 +223,11 @@ class MysteryBox {
     const v = this.versionParameters[version];
     offset += v.versionBytes;
 
+    const minBytes = v.versionBytes + v.flagsBytes + v.ivBytes + v.saltBytes + v.tagBytes;
+    if (raw.length < minBytes) {
+      throw new RangeError('not enough to unpack');
+    }
+
     const flags = raw.slice(offset, offset + v.flagsBytes).readUInt8(0);
     offset += v.flagsBytes;