diff --git a/src/node_buffer.cc b/src/node_buffer.cc index 14c83a65c2c1f9..57bfb87de05b04 100644 --- a/src/node_buffer.cc +++ b/src/node_buffer.cc @@ -207,6 +207,11 @@ inline MUST_USE_RESULT bool ParseArrayIndex(Local arg, if (tmp_i < 0) return false; + // Check that the result fits in a size_t. + const uint64_t kSizeMax = static_cast(static_cast(-1)); + if (static_cast(tmp_i) > kSizeMax) + return false; + *ret = static_cast(tmp_i); return true; } diff --git a/test/parallel/test-buffer-alloc.js b/test/parallel/test-buffer-alloc.js index a1f7cae33f8504..42f8e270462c48 100644 --- a/test/parallel/test-buffer-alloc.js +++ b/test/parallel/test-buffer-alloc.js @@ -1462,6 +1462,13 @@ assert.throws(function() { Buffer.from(new ArrayBuffer(0), -1 >>> 0); }, /RangeError: 'offset' is out of bounds/); +// ParseArrayIndex() should reject values that don't fit in a 32 bits size_t. +assert.throws(() => { + const a = Buffer(1).fill(0); + const b = Buffer(1).fill(0); + a.copy(b, 0, 0x100000000, 0x100000001); +}), /out of range index/; + // Unpooled buffer (replaces SlowBuffer) const ubuf = Buffer.allocUnsafeSlow(10); assert(ubuf);