src: guard against overflow in ParseArrayIndex() · nodejs/node@630096b

Original file line numberDiff line numberDiff line change

@@ -1462,6 +1462,13 @@ assert.throws(function() {

14621462

Buffer.from(new ArrayBuffer(0), -1 >>> 0);

14631463

}, /RangeError: 'offset' is out of bounds/);

14641464
1465+

// ParseArrayIndex() should reject values that don't fit in a 32 bits size_t.

1466+

assert.throws(() => {

1467+

const a = Buffer(1).fill(0);

1468+

const b = Buffer(1).fill(0);

1469+

a.copy(b, 0, 0x100000000, 0x100000001);

1470+

}), /out of range index/;

1471+
14651472

// Unpooled buffer (replaces SlowBuffer)

14661473

const ubuf = Buffer.allocUnsafeSlow(10);

14671474

assert(ubuf);