Prevent infinite loops for corrupt options

1 files changed, 9 insertions, 4 deletions

diff --git a/ext/bg/js/options.js b/ext/bg/js/options.js
index df95aae9..d903250e 100644
--- a/ext/bg/js/options.js
+++ b/ext/bg/js/options.js
@@ -305,14 +305,19 @@ function optionsVersion(options) {
     ];
 
     optionsSetDefaults(options);
-    if (!options.hasOwnProperty('version')) {
-        options.version = fixups.length;
+
+    let version = options.version;
+    if (typeof version !== 'number' || !Number.isFinite(version)) {
+        version = fixups.length;
+    } else {
+        version = Math.max(0, Math.floor(version));
     }
 
-    while (options.version < fixups.length) {
-        fixups[options.version++]();
+    for (; version < fixups.length; ++version) {
+        fixups[version]();
     }
 
+    options.version = version;
     return options;
 }