Skip to content

Commit 1d0f2cb

Browse files
trevnorrisjasnell
authored andcommitted
buffer: fix value check for writeUInt{B,L}E
Fixes: #3497 PR-URL: #3500 Reviewed-By: Ben Noordhuis <[email protected]>
1 parent 0429131 commit 1d0f2cb

File tree

2 files changed

+27
-4
lines changed

2 files changed

+27
-4
lines changed

lib/buffer.js

+8-4
Original file line numberDiff line numberDiff line change
@@ -836,8 +836,10 @@ Buffer.prototype.writeUIntLE = function(value, offset, byteLength, noAssert) {
836836
value = +value;
837837
offset = offset >>> 0;
838838
byteLength = byteLength >>> 0;
839-
if (!noAssert)
840-
checkInt(this, value, offset, byteLength, Math.pow(2, 8 * byteLength), 0);
839+
if (!noAssert) {
840+
const maxBytes = Math.pow(2, 8 * byteLength) - 1;
841+
checkInt(this, value, offset, byteLength, maxBytes, 0);
842+
}
841843

842844
var mul = 1;
843845
var i = 0;
@@ -853,8 +855,10 @@ Buffer.prototype.writeUIntBE = function(value, offset, byteLength, noAssert) {
853855
value = +value;
854856
offset = offset >>> 0;
855857
byteLength = byteLength >>> 0;
856-
if (!noAssert)
857-
checkInt(this, value, offset, byteLength, Math.pow(2, 8 * byteLength), 0);
858+
if (!noAssert) {
859+
const maxBytes = Math.pow(2, 8 * byteLength) - 1;
860+
checkInt(this, value, offset, byteLength, maxBytes, 0);
861+
}
858862

859863
var i = byteLength - 1;
860864
var mul = 1;

test/parallel/test-writeuint.js

+19
Original file line numberDiff line numberDiff line change
@@ -122,6 +122,25 @@ function test32(clazz) {
122122
}
123123

124124

125+
function testUint(clazz) {
126+
const data = new clazz(8);
127+
var val = 1;
128+
129+
// Test 0 to 5 bytes.
130+
for (var i = 0; i <= 5; i++) {
131+
const errmsg = `byteLength: ${i}`;
132+
ASSERT.throws(function() {
133+
data.writeUIntBE(val, 0, i);
134+
}, /value is out of bounds/, errmsg);
135+
ASSERT.throws(function() {
136+
data.writeUIntLE(val, 0, i);
137+
}, /value is out of bounds/, errmsg);
138+
val *= 0x100;
139+
}
140+
}
141+
142+
125143
test8(Buffer);
126144
test16(Buffer);
127145
test32(Buffer);
146+
testUint(Buffer);

0 commit comments

Comments
 (0)