GeezerVison

The World Wide Web, restored to 800 pixels of glory.

GeezerVison is showing github.com — buffer: validate copyArrayBuffer offsets against buffer length · nodejs/node@5fda095

File tree

Expand file treeCollapse file tree

Open diff view settings

Filter options

src
- node_buffer.cc

Expand file treeCollapse file tree

Open diff view settings

Collapse file

`‎src/node_buffer.cc‎`

Copy file name to clipboardExpand all lines: src/node_buffer.cc

+4Lines changed: 4 additions & 0 deletions

Original file line number	Diff line number	Diff line change
`@@ -1625,6 +1625,10 @@ void CopyArrayBuffer(const FunctionCallbackInfo<Value>& args) {`
`1625`	`1625`	`uint32_t source_offset = args[3].As<Uint32>()->Value();`
`1626`	`1626`	`size_t bytes_to_copy = args[4].As<Uint32>()->Value();`
`1627`	`1627`
	`1628`	`+ // Assert the offsets are within bounds before the subtractions below, which`
	`1629`	`+ // would otherwise underflow and defeat the bytes_to_copy bounds checks.`
	`1630`	`+ CHECK_LE(destination_offset, destination_byte_length);`
	`1631`	`+ CHECK_LE(source_offset, source_byte_length);`
`1628`	`1632`	`CHECK_GE(destination_byte_length - destination_offset, bytes_to_copy);`
`1629`	`1633`	`CHECK_GE(source_byte_length - source_offset, bytes_to_copy);`
`1630`	`1634`

0 commit comments

Comments

0 (0)

You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.