diff --git a/src/node_buffer.cc b/src/node_buffer.cc index f0de2872b0..ffc11cd989 100644 --- a/src/node_buffer.cc +++ b/src/node_buffer.cc @@ -207,6 +207,11 @@ inline MUST_USE_RESULT bool ParseArrayIndex(Local arg, if (tmp_i < 0) return false; + // Check that the result fits in a size_t. + const uint64_t kSizeMax = static_cast(static_cast(-1)); + if (static_cast(tmp_i) > kSizeMax) + return false; + *ret = static_cast(tmp_i); return true; } diff --git a/test/parallel/test-buffer-alloc.js b/test/parallel/test-buffer-alloc.js index d76d921664..76a34319c1 100644 --- a/test/parallel/test-buffer-alloc.js +++ b/test/parallel/test-buffer-alloc.js @@ -1454,6 +1454,13 @@ assert.throws(function() { Buffer.from(new ArrayBuffer(0), -1 >>> 0); }, /RangeError: 'offset' is out of bounds/); +// ParseArrayIndex() should reject values that don't fit in a 32 bits size_t. +assert.throws(() => { + const a = Buffer(1).fill(0); + const b = Buffer(1).fill(0); + a.copy(b, 0, 0x100000000, 0x100000001); +}), /out of range index/; + // Unpooled buffer (replaces SlowBuffer) const ubuf = Buffer.allocUnsafeSlow(10); assert(ubuf);