From 6899fef4780f19c5b6b7e1390ca2823b47564358 Mon Sep 17 00:00:00 2001
From: Anna Henningsen <anna@addaleax.net>
Date: Tue, 29 Nov 2016 05:22:40 -0600
Subject: [PATCH] buffer: fix transcode for single-byte enc to ucs2

Fix `buffer.transcode()` for transcoding from single-byte character
encodings to UCS2.

These would previously perform out-of-bounds reads due to an
incorrect `sizeof()` expression.

Fixes: https://github.com/nodejs/node/issues/9834
---
 src/node_i18n.cc                    |  2 +-
 test/parallel/test-icu-transcode.js | 10 ++++++++++
 2 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/src/node_i18n.cc b/src/node_i18n.cc
index bab06cfcdfc41a..a98fdca4d1bffd 100644
--- a/src/node_i18n.cc
+++ b/src/node_i18n.cc
@@ -179,7 +179,7 @@ MaybeLocal<Object> TranscodeToUcs2(Isolate* isolate,
   MaybeLocal<Object> ret;
   MaybeStackBuffer<UChar> destbuf(source_length);
   Converter from(fromEncoding);
-  const size_t length_in_chars = source_length * sizeof(*destbuf);
+  const size_t length_in_chars = source_length * sizeof(UChar);
   ucnv_toUChars(from.conv, *destbuf, length_in_chars,
                 source, source_length, status);
   if (U_SUCCESS(*status))
diff --git a/test/parallel/test-icu-transcode.js b/test/parallel/test-icu-transcode.js
index f45b9974367af3..2cdd4078a2cceb 100644
--- a/test/parallel/test-icu-transcode.js
+++ b/test/parallel/test-icu-transcode.js
@@ -46,3 +46,13 @@ assert.throws(
   () => buffer.transcode(Buffer.from('a'), 'uf8', 'b'),
   /Unable to transcode Buffer \[U_ILLEGAL_ARGUMENT_ERROR\]/
 );
+
+assert.deepStrictEqual(
+    buffer.transcode(Buffer.from('hi', 'ascii'), 'ascii', 'utf16le'),
+    Buffer.from('hi', 'utf16le'));
+assert.deepStrictEqual(
+    buffer.transcode(Buffer.from('hi', 'latin1'), 'latin1', 'utf16le'),
+    Buffer.from('hi', 'utf16le'));
+assert.deepStrictEqual(
+    buffer.transcode(Buffer.from('hä', 'latin1'), 'latin1', 'utf16le'),
+    Buffer.from('hä', 'utf16le'));