fix: correct off-by-one error in parameterCount

[abhu85]

Summary

Fix off-by-one error in parameterCount that causes large arrays to be parsed as objects with qs@6.14.2.

Problem

The parameterCount function counts & characters but returns that count directly. Since the number of parameters equals the number of & characters plus one, this causes an off-by-one error.

For example, with a[0]=1&a[1]=2&...&a[199]=200 (200 parameters):

• Before fix: returned 199 (count of & chars)
• After fix: returns 200 (actual parameter count)

This became problematic with qs@6.14.2 which changed arrayLimit behavior to restrict array length instead of max index.

Solution

Change return count to return count + 1 in parameterCount.

Test Plan

• Added test case for array parsing with 110 elements
• All 263 tests pass
• Linting passes

Compatibility

• No breaking changes
• Backwards compatible (arrays that worked before still work)

Fixes #715

[krzysdz]

There already is a test that verifies this

body-parser/test/urlencoded.js

Lines 167 to 185 in b849bd5

	it('should parse array index notation with large array', function (done) {
	var str = 'f[0]=0'
	for (var i = 1; i < 500; i++) {
	str += '&f[' + i + ']=' + i.toString(16)
	}
	request(this.server)
	.post('/')
	.set('Content-Type', 'application/x-www-form-urlencoded')
	.send(str)
	.expect(function (res) {
	var obj = JSON.parse(res.text)
	assert.strictEqual(Object.keys(obj).length, 1)
	assert.strictEqual(Array.isArray(obj.f), true)
	assert.strictEqual(obj.f.length, 500)
	})
	.expect(200, done)
	})

[abhu85]

Thanks for pointing that out. I see the existing test at L167-185 with 500 elements.

I added my test because I wanted to verify the specific off-by-one fix, but you're right that the existing test should theoretically catch this too since:

• 500 parameters → paramCount returns 499 (bug)
• arrayLimit = Max.max(100, 499) = 499
• qs 6.14.2+ would convert index 499 to object key

Does the existing test currently fail on main without this fix? If so, I'm happy to remove my test as redundant. If there's something causing it to pass despite the bug, my test provides additional coverage.