GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — fix: throw when encoding a BigInt outside int64/uint64 range by spokodev · Pull Request #290 · msgpack/msgpack-javascript

Conversation

@spokodev

@spokodev spokodev commented Jun 30, 2026

Copy link
Copy Markdown

Problem

With useBigInt64: true, encodeBigInt64 branches only on the sign of the value and calls the native DataView.setBigUint64 / setBigInt64. Those methods truncate the value mod 2^64 instead of throwing, so a BigInt outside the representable range is silently corrupted on encode:

import { encode, decode } from "@msgpack/msgpack";

decode(encode(2n ** 64n,         { useBigInt64: true }), { useBigInt64: true }); // 0n
decode(encode(2n ** 64n + 1n,    { useBigInt64: true }), { useBigInt64: true }); // 1n
decode(encode(-(2n ** 63n) - 1n, { useBigInt64: true }), { useBigInt64: true }); // 9223372036854775807n  (sign flip)
decode(encode(-(2n ** 100n),     { useBigInt64: true }), { useBigInt64: true }); // 0n

No error is raised, so the caller has no way to notice the data loss.

Fix

The MessagePack int family is fixed 64-bit, so the only representable range for a BigInt is the union of signed int64 and unsigned uint64: [-2^63, 2^64 - 1]. This adds a range check in encodeBigInt64 that throws for anything outside that range, before the writes.

This matches how the encoder already rejects other unrepresentable inputs (too-long strings, too-large arrays/maps/binaries all throw rather than emit corrupt bytes).

Tests

Extended test/bigint64.test.ts:

  • the four out-of-range cases above now throw
  • the boundary values still round-trip: 0n, 42n, 2n ** 63n - 1n (max int64), -(2n ** 63n) (min int64), 2n ** 64n - 1n (max uint64)

Full suite: 329 passing, lint clean.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions
@spokodev
fix: throw when encoding a BigInt outside int64/uint64 range
7543d04
With `useBigInt64: true`, `encodeBigInt64` branched only on sign and
called the native `DataView.setBigUint64`/`setBigInt64`, which truncate
mod 2^64 without throwing. A BigInt outside the representable range was
silently corrupted on encode:

    encode(2n ** 64n,        { useBigInt64: true }) // decoded as 0n
    encode(2n ** 64n + 1n,   { useBigInt64: true }) // decoded as 1n
    encode(-(2n ** 63n) - 1n,{ useBigInt64: true }) // sign flip: 9223372036854775807n

The MessagePack int family is fixed 64-bit, so the only representable
range is the union of int64 and uint64: [-2^63, 2^64 - 1]. Add a range
check that throws for anything outside it, matching how the encoder
already rejects other unrepresentable inputs (too-long strings, too-large
arrays/maps/binaries).
michaelficarra
michaelficarra reviewed Jun 30, 2026
View reviewed changes
Comment thread src/Encoder.ts Outdated
Comment on lines +292 to +294

private encodeBigInt64(object: bigint): void {
if (object < -(BigInt(2) ** BigInt(63)) || object > BigInt(2) ** BigInt(64) - BigInt(1)) {

@michaelficarra michaelficarra Jun 30, 2026

Copy link
Copy Markdown

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
private encodeBigInt64(object: bigint): void {
if (object < -(BigInt(2) ** BigInt(63)) || object > BigInt(2) ** BigInt(64) - BigInt(1)) {
const INT64_MIN = -(BigInt(2) ** BigInt(63));
const UINT64_MAX = BigInt(2) ** BigInt(64) - BigInt(1);
private encodeBigInt64(object: bigint): void {
if (object < INT64_MIN || object > UINT64_MAX) {

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions
@spokodev
refactor: hoist int64/uint64 bounds to module constants
1a99635
Compute the int64/uint64 range bounds once at module load instead of on
every encodeBigInt64 call, per review feedback.
@spokodev

spokodev commented Jul 3, 2026

Copy link
Copy Markdown
Author

Done, hoisted INT64_MIN and UINT64_MAX to module constants so the bounds are computed once instead of on every encodeBigInt64 call.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

1 more reviewer
@michaelficarra michaelficarra michaelficarra left review comments
Reviewers whose approvals may not affect merge requirements

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

2 participants

@spokodev @michaelficarra
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.