From 68ad3408d45d577cc5d62c85e4a1b5b61ffb8af2 Mon Sep 17 00:00:00 2001
From: Oskar Eichler <oskar@songstats.com>
Date: Fri, 28 Aug 2026 15:51:16 +0300
Subject: [PATCH] Reject unterminated source map VLQ values

---
 CHANGELOG.md                      | 2 ++
 README.md                         | 2 ++
 lib/sprockets/source_map_utils.rb | 1 +
 3 files changed, 5 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6366a4d92..5a9124606 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,7 @@
 **Master**
 
+- Reject unterminated source map VLQ values. [Oskar Eichler](https://github.com/OskarEichler)
+
 Get upgrade notes from Sprockets 3.x to 4.x at https://github.com/rails/sprockets/blob/master/UPGRADING.md
 
 # 4.4.1
diff --git a/README.md b/README.md
index 958b44cd4..9380df78f 100644
--- a/README.md
+++ b/README.md
@@ -714,3 +714,5 @@ Please see the [CHANGELOG](https://github.com/rails/sprockets/tree/master/CHANGE
 
 ## License
 Sprockets is released under the [MIT License](MIT-LICENSE).
+
+An unterminated VLQ value raises ArgumentError instead of silently returning a partial decoded result.
diff --git a/lib/sprockets/source_map_utils.rb b/lib/sprockets/source_map_utils.rb
index b2ae018be..c6d3bed0e 100644
--- a/lib/sprockets/source_map_utils.rb
+++ b/lib/sprockets/source_map_utils.rb
@@ -446,6 +446,7 @@ def vlq_decode(str)
         end
         i += 1
       end
+      raise ArgumentError unless shift.zero?
       result
     end