GeezerVison

The World Wide Web, restored to 800 pixels of glory.

GeezerVison is showing github.com — buffer: prevent string write offset overflow · nodejs/node@7e7e7c1

File tree

Expand file treeCollapse file tree

Open diff view settings

Filter options

lib/internal
- buffer.js
src
- node_buffer.cc
test/parallel
- test-buffer-write.js

Expand file treeCollapse file tree

Open diff view settings

Collapse file

`‎lib/internal/buffer.js‎`

Copy file name to clipboardExpand all lines: lib/internal/buffer.js

+12-3Lines changed: 12 additions & 3 deletions

Original file line number	Diff line number	Diff line change
`@@ -959,30 +959,39 @@ function writeFloatBackwards(val, offset = 0) {`
`959`	`959`
`960`	`960`	`class FastBuffer extends Uint8Array {}`
`961`	`961`
`962`		`-function asciiWrite(buf, string, offset = 0, length = buf.byteLength - offset) {`
	`962`	`+function asciiWrite(buf, string, offset = 0, length) {`
	`963`	`+ offset = Number(offset);`
`963`	`964`	`if (offset < 0 \|\| offset > buf.byteLength) {`
`964`	`965`	`throw new ERR_BUFFER_OUT_OF_BOUNDS('offset');`
`965`	`966`	`}`
	`967`	`+ if (length === undefined) length = buf.byteLength - offset;`
	`968`	`+ else length = Number(length);`
`966`	`969`	`if (length < 0 \|\| length > buf.byteLength - offset) {`
`967`	`970`	`throw new ERR_BUFFER_OUT_OF_BOUNDS('length');`
`968`	`971`	`}`
`969`	`972`	`return asciiWriteStatic(buf, string, offset, length);`
`970`	`973`	`}`
`971`	`974`
`972`		`-function latin1Write(buf, string, offset = 0, length = buf.byteLength - offset) {`
	`975`	`+function latin1Write(buf, string, offset = 0, length) {`
	`976`	`+ offset = Number(offset);`
`973`	`977`	`if (offset < 0 \|\| offset > buf.byteLength) {`
`974`	`978`	`throw new ERR_BUFFER_OUT_OF_BOUNDS('offset');`
`975`	`979`	`}`
	`980`	`+ if (length === undefined) length = buf.byteLength - offset;`
	`981`	`+ else length = Number(length);`
`976`	`982`	`if (length < 0 \|\| length > buf.byteLength - offset) {`
`977`	`983`	`throw new ERR_BUFFER_OUT_OF_BOUNDS('length');`
`978`	`984`	`}`
`979`	`985`	`return latin1WriteStatic(buf, string, offset, length);`
`980`	`986`	`}`
`981`	`987`
`982`		`-function utf8Write(buf, string, offset = 0, length = buf.byteLength - offset) {`
	`988`	`+function utf8Write(buf, string, offset = 0, length) {`
	`989`	`+ offset = Number(offset);`
`983`	`990`	`if (offset < 0 \|\| offset > buf.byteLength) {`
`984`	`991`	`throw new ERR_BUFFER_OUT_OF_BOUNDS('offset');`
`985`	`992`	`}`
	`993`	`+ if (length === undefined) length = buf.byteLength - offset;`
	`994`	`+ else length = Number(length);`
`986`	`995`	`if (length < 0 \|\| length > buf.byteLength - offset) {`
`987`	`996`	`throw new ERR_BUFFER_OUT_OF_BOUNDS('length');`
`988`	`997`	`}`

Collapse file

`‎src/node_buffer.cc‎`

Copy file name to clipboardExpand all lines: src/node_buffer.cc

+5Lines changed: 5 additions & 0 deletions

Original file line number	Diff line number	Diff line change
`@@ -1631,6 +1631,11 @@ void SlowWriteString(const FunctionCallbackInfo<Value>& args) {`
`1631`	`1631`	`size_t max_length = 0;`
`1632`	`1632`
`1633`	`1633`	`THROW_AND_RETURN_IF_OOB(ParseArrayIndex(env, args[2], 0, &offset));`
	`1634`	`+ if (offset > ts_obj_length) {`
	`1635`	`+ return node::THROW_ERR_BUFFER_OUT_OF_BOUNDS(`
	`1636`	`+ env, "\"offset\" is outside of buffer bounds");`
	`1637`	`+ }`
	`1638`	`+`
`1634`	`1639`	`THROW_AND_RETURN_IF_OOB(`
`1635`	`1640`	`ParseArrayIndex(env, args[3], ts_obj_length - offset, &max_length));`
`1636`	`1641`

Collapse file

`‎test/parallel/test-buffer-write.js‎`

Copy file name to clipboardExpand all lines: test/parallel/test-buffer-write.js

+14Lines changed: 14 additions & 0 deletions

Original file line number	Diff line number	Diff line change
`@@ -127,3 +127,17 @@ assert.throws(() => {`
`127`	`127`	`}, common.expectsError({`
`128`	`128`	`code: 'ERR_BUFFER_OUT_OF_BOUNDS',`
`129`	`129`	`}));`
	`130`	`+`
	`131`	`+for (const method of ['asciiWrite', 'latin1Write', 'utf8Write']) {`
	`132`	`+ let calls = 0;`
	`133`	`+ const offset = {`
	`134`	`+ valueOf() {`
	`135`	`+ calls++;`
	`136`	`+ return 2;`
	`137`	`+ },`
	`138`	`+ };`
	`139`	`+ assert.throws(() => Buffer.alloc(1)[method]('ww', offset, 1), common.expectsError({`
	`140`	`+ code: 'ERR_BUFFER_OUT_OF_BOUNDS',`
	`141`	`+ }));`
	`142`	`+ assert.strictEqual(calls, 1);`
	`143`	`+}`

0 commit comments

Comments

0 (0)

You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.