Skip to content

Commit 6a04cc0

Browse files
trevnorrisrvagg
authored andcommitted
buffer: fix value check for writeUInt{B,L}E
Fixes: #3497 PR-URL: #3500 Reviewed-By: Ben Noordhuis <[email protected]>
1 parent 0317c88 commit 6a04cc0

File tree

2 files changed

+27
-4
lines changed

2 files changed

+27
-4
lines changed

lib/buffer.js

+8-4
Original file line numberDiff line numberDiff line change
@@ -832,8 +832,10 @@ Buffer.prototype.writeUIntLE = function(value, offset, byteLength, noAssert) {
832832
value = +value;
833833
offset = offset >>> 0;
834834
byteLength = byteLength >>> 0;
835-
if (!noAssert)
836-
checkInt(this, value, offset, byteLength, Math.pow(2, 8 * byteLength), 0);
835+
if (!noAssert) {
836+
const maxBytes = Math.pow(2, 8 * byteLength) - 1;
837+
checkInt(this, value, offset, byteLength, maxBytes, 0);
838+
}
837839

838840
var mul = 1;
839841
var i = 0;
@@ -849,8 +851,10 @@ Buffer.prototype.writeUIntBE = function(value, offset, byteLength, noAssert) {
849851
value = +value;
850852
offset = offset >>> 0;
851853
byteLength = byteLength >>> 0;
852-
if (!noAssert)
853-
checkInt(this, value, offset, byteLength, Math.pow(2, 8 * byteLength), 0);
854+
if (!noAssert) {
855+
const maxBytes = Math.pow(2, 8 * byteLength) - 1;
856+
checkInt(this, value, offset, byteLength, maxBytes, 0);
857+
}
854858

855859
var i = byteLength - 1;
856860
var mul = 1;

test/parallel/test-writeuint.js

+19
Original file line numberDiff line numberDiff line change
@@ -122,6 +122,25 @@ function test32(clazz) {
122122
}
123123

124124

125+
function testUint(clazz) {
126+
const data = new clazz(8);
127+
var val = 1;
128+
129+
// Test 0 to 5 bytes.
130+
for (var i = 0; i <= 5; i++) {
131+
const errmsg = `byteLength: ${i}`;
132+
ASSERT.throws(function() {
133+
data.writeUIntBE(val, 0, i);
134+
}, /value is out of bounds/, errmsg);
135+
ASSERT.throws(function() {
136+
data.writeUIntLE(val, 0, i);
137+
}, /value is out of bounds/, errmsg);
138+
val *= 0x100;
139+
}
140+
}
141+
142+
125143
test8(Buffer);
126144
test16(Buffer);
127145
test32(Buffer);
146+
testUint(Buffer);

0 commit comments

Comments
 (0)