Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Appearance settings

Commit 98f51ff

Browse filesBrowse files
indutnycjihrig
authored andcommitted
buffer: fix unintended unsigned overflow
`offset` is user supplied variable and may be bigger than `ts_obj_length`. There is no need to subtract them and pass along, so just throw when the subtraction result would overflow. PR-URL: #7494 Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
1 parent b3164ae commit 98f51ff
Copy full SHA for 98f51ff

File tree

Expand file treeCollapse file tree

1 file changed

+3
-3
lines changed
Open diff view settings
Filter options
Expand file treeCollapse file tree

1 file changed

+3
-3
lines changed
Open diff view settings
Collapse file

‎src/node_buffer.cc‎

Copy file name to clipboardExpand all lines: src/node_buffer.cc
+3-3Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -718,16 +718,16 @@ void StringWrite(const FunctionCallbackInfo<Value>& args) {
718718
size_t max_length;
719719

720720
CHECK_NOT_OOB(ParseArrayIndex(args[1], 0, &offset));
721+
if (offset >= ts_obj_length)
722+
return env->ThrowRangeError("Offset is out of bounds");
723+
721724
CHECK_NOT_OOB(ParseArrayIndex(args[2], ts_obj_length - offset, &max_length));
722725

723726
max_length = MIN(ts_obj_length - offset, max_length);
724727

725728
if (max_length == 0)
726729
return args.GetReturnValue().Set(0);
727730

728-
if (offset >= ts_obj_length)
729-
return env->ThrowRangeError("Offset is out of bounds");
730-
731731
uint32_t written = StringBytes::Write(env->isolate(),
732732
ts_obj_data + offset,
733733
max_length,

0 commit comments

Comments
0 (0)
Morty Proxy This is a proxified and sanitized view of the page, visit original site.