Fix CVE-2026-93749: validate section offsets in indexed source maps - #78

diff --git a/lib/source-map-consumer.js b/lib/source-map-consumer.js
index d25b494..a391dc6 100644
--- a/lib/source-map-consumer.js
+++ b/lib/source-map-consumer.js
@@ -15,6 +15,17 @@ var ArraySet = require('./array-set').ArraySet;
 // `_names._array`.
 var base64DecodeTable = require('./base64').charToIntMap;
 
+// Upper bound for a section's `offset.line`/`offset.column` in an indexed
+// source map. Consumers of a parsed map (e.g. SourceNode.fromStringWithSourceMap,
+// SourceMapGenerator's mappings serializer) walk generated line numbers one at
+// a time, so an unvalidated, attacker-supplied offset that is large (or
+// Infinity/NaN) can force a synchronous loop with an effectively unbounded
+// iteration count, blocking the event loop (CVE-2026-93749). 2 million is
+// already far beyond the line/column count of any realistic generated file
+// (or of a value legitimately used as a section offset), while keeping the
+// worst-case synchronous loop bounded to roughly a hundred milliseconds.
+var MAX_VALID_OFFSET_LINE = 2e6;
+
 function SourceMapConsumer(aSourceMap, aSourceMapURL) {
   var sourceMap = aSourceMap;
   if (typeof aSourceMap === 'string') {
@@ -1494,6 +1505,26 @@ function IndexedSourceMapConsumer(aSourceMap, aSourceMapURL) {
     var offsetLine = util.getArg(offset, 'line');
     var offsetColumn = util.getArg(offset, 'column');
 
+    // Reject non-integer, negative, or unreasonably large offset values.
+    // Section offsets are used elsewhere (e.g. when generating output or
+    // walking generated lines) in loops that advance one line at a time,
+    // so an unvalidated, attacker-controlled offset.line (for example
+    // Infinity or a huge number) can cause synchronous, near-unbounded
+    // looping and block the event loop. MAX_VALID_OFFSET_LINE is a
+    // generous but finite ceiling well beyond any legitimate source file.
+    if (typeof offsetLine !== 'number' ||
+        typeof offsetColumn !== 'number' ||
+        !isFinite(offsetLine) ||
+        !isFinite(offsetColumn) ||
+        !Number.isInteger(offsetLine) ||
+        !Number.isInteger(offsetColumn) ||
+        offsetLine < 0 ||
+        offsetColumn < 0 ||
+        offsetLine > MAX_VALID_OFFSET_LINE ||
+        offsetColumn > MAX_VALID_OFFSET_LINE) {
+      throw new Error('Section offset must be a non-negative integer within a reasonable range.');
+    }
+
     if (offsetLine < lastOffset.line ||
         (offsetLine === lastOffset.line && offsetColumn < lastOffset.column)) {
       throw new Error('Section offsets must be ordered and non-overlapping.');
diff --git a/test/public/test-source-map-consumer.js b/test/public/test-source-map-consumer.js
index 558e07c..7b0d7f8 100644
--- a/test/public/test-source-map-consumer.js
+++ b/test/public/test-source-map-consumer.js
@@ -919,6 +919,63 @@ test('test indexed source map errors when sections are out of order by line', ()
   }, Error);
 });
 
+// CVE-2026-93749: source-map-js failed to validate the per-section
+// `offset.line`/`offset.column` values in indexed source maps, letting an
+// attacker supply extremely large (or non-finite/non-integer) offset values
+// that cause synchronous, near-unbounded looping in downstream consumers
+// (e.g. SourceNode.fromStringWithSourceMap), blocking the event loop.
+test('test indexed source map rejects unreasonably large section offsets (CVE-2026-93749)', () => {
+  var badOffsets = [
+    Infinity,
+    -Infinity,
+    NaN,
+    1e9,
+    2e6 + 1, // just over the allowed maximum
+    -1,
+    1.5,
+    '5', // not a number
+    null
+  ];
+
+  badOffsets.forEach(function(offsetLine) {
+    var map = JSON.parse(JSON.stringify(util.indexedTestMap));
+    map.sections[0].offset = {
+      line: offsetLine,
+      column: 0
+    };
+
+    assert.throws(function() {
+      new SourceMapConsumer(map);
+    }, Error, 'offset.line = ' + offsetLine + ' should be rejected');
+  });
+
+  // Bad offset.column values should be rejected the same way.
+  var badColumns = [Infinity, NaN, 2e6 + 1, -1, 1.5, '5'];
+  badColumns.forEach(function(offsetColumn) {
+    var map = JSON.parse(JSON.stringify(util.indexedTestMap));
+    map.sections[0].offset = {
+      line: 0,
+      column: offsetColumn
+    };
+
+    assert.throws(function() {
+      new SourceMapConsumer(map);
+    }, Error, 'offset.column = ' + offsetColumn + ' should be rejected');
+  });
+});
+
+test('test indexed source map accepts valid, reasonably-sized section offsets', () => {
+  var map = JSON.parse(JSON.stringify(util.indexedTestMap));
+  map.sections[0].offset = {
+    line: 0,
+    column: 0
+  };
+
+  assert.doesNotThrow(function() {
+    new SourceMapConsumer(map);
+  });
+});
+
 test('test github issue #64', () => {
   var map = new SourceMapConsumer({
     "version": 3,