[Fix] parse: mark overflow objects for indexed notation exceeding arrayLimit

Fixes #546

Author: ljharb

lib/parse.js

@@ -199,6 +199,9 @@ var parseObject = function (chain, val, options, valuesParsed) {
                 obj[index] = leaf;
             } else if (isValidArrayIndex && options.throwOnLimitExceeded) {
                 throw new RangeError('Array limit exceeded. Only ' + options.arrayLimit + ' element' + (options.arrayLimit === 1 ? '' : 's') + ' allowed in an array.');
+            } else if (isValidArrayIndex) {
+                obj[index] = leaf;
+                utils.markOverflow(obj, index);
             } else if (decodedRoot !== '__proto__') {
                 obj[decodedRoot] = leaf;
             }

lib/utils.js

@@ -147,6 +147,17 @@ var merge = function merge(target, source, options) {
         } else {
             acc[key] = value;
         }
+
+        if (isOverflow(source) && !isOverflow(acc)) {
+            markOverflow(acc, getMaxIndex(source));
+        }
+        if (isOverflow(acc)) {
+            var keyNum = parseInt(key, 10);
+            if (String(keyNum) === key && keyNum >= 0 && keyNum > getMaxIndex(acc)) {
+                setMaxIndex(acc, keyNum);
+            }
+        }
+
         return acc;
     }, mergeTarget);
 };
@@ -323,6 +334,7 @@ module.exports = {
     isBuffer: isBuffer,
     isOverflow: isOverflow,
     isRegExp: isRegExp,
+    markOverflow: markOverflow,
     maybeMap: maybeMap,
     merge: merge
 };

test/parse.js

@@ -1484,5 +1484,29 @@ test('mixed array and object notation', function (t) {
         st.end();
     });
 
+    t.test('mixed notation produces consistent results when arrayLimit is exceeded', function (st) {
+        var expected = { a: { 0: 'b', 1: 'c', 2: 'd' } };
+
+        st.deepEqual(
+            qs.parse('a[]=b&a[1]=c&a=d', { arrayLimit: -1 }),
+            expected,
+            'arrayLimit -1'
+        );
+
+        st.deepEqual(
+            qs.parse('a[]=b&a[1]=c&a=d', { arrayLimit: 0 }),
+            expected,
+            'arrayLimit 0'
+        );
+
+        st.deepEqual(
+            qs.parse('a[]=b&a[1]=c&a=d', { arrayLimit: 1 }),
+            expected,
+            'arrayLimit 1'
+        );
+
+        st.end();
+    });
+
     t.end();
 });