Skip to content

Commit 46f40cf

Browse files
committed
buffer: fix unintended unsigned overflow
`offset` is user supplied variable and may be bigger than `ts_obj_length`. There is no need to subtract them and pass along, so just throw when the subtraction result would overflow. PR-URL: #7494 Reviewed-By: Ben Noordhuis <[email protected]>
1 parent a528d0d commit 46f40cf

File tree

1 file changed

+3
-3
lines changed

1 file changed

+3
-3
lines changed

src/node_buffer.cc

+3-3
Original file line numberDiff line numberDiff line change
@@ -718,16 +718,16 @@ void StringWrite(const FunctionCallbackInfo<Value>& args) {
718718
size_t max_length;
719719

720720
CHECK_NOT_OOB(ParseArrayIndex(args[1], 0, &offset));
721+
if (offset >= ts_obj_length)
722+
return env->ThrowRangeError("Offset is out of bounds");
723+
721724
CHECK_NOT_OOB(ParseArrayIndex(args[2], ts_obj_length - offset, &max_length));
722725

723726
max_length = MIN(ts_obj_length - offset, max_length);
724727

725728
if (max_length == 0)
726729
return args.GetReturnValue().Set(0);
727730

728-
if (offset >= ts_obj_length)
729-
return env->ThrowRangeError("Offset is out of bounds");
730-
731731
uint32_t written = StringBytes::Write(env->isolate(),
732732
ts_obj_data + offset,
733733
max_length,

0 commit comments

Comments
 (0)