From 5229ffadcf16aa804e551bfacc8e977d3ba8d3d1 Mon Sep 17 00:00:00 2001
From: Anna Henningsen <anna@addaleax.net>
Date: Wed, 9 Sep 2020 23:11:21 +0200
Subject: [PATCH] buffer: adjust validation to account for buffer.kMaxLength

PR-URL: https://github.com/nodejs/node/pull/35134
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Yongsheng Zhang <zyszys98@gmail.com>
---
 lib/buffer.js | 23 +++++++++++++----------
 1 file changed, 13 insertions(+), 10 deletions(-)

diff --git a/lib/buffer.js b/lib/buffer.js
index 90ebe8866b582c..bed6bcbae47193 100644
--- a/lib/buffer.js
+++ b/lib/buffer.js
@@ -95,9 +95,12 @@ const {
 } = require('internal/errors');
 const {
   validateBuffer,
-  validateInt32,
+  validateInteger,
   validateString
 } = require('internal/validators');
+// Provide validateInteger() but with kMaxLength as the default maximum value.
+const validateOffset = (value, name, min = 0, max = kMaxLength) =>
+  validateInteger(value, name, min, max);
 
 const {
   FastBuffer,
@@ -557,7 +560,7 @@ Buffer.concat = function concat(list, length) {
       }
     }
   } else {
-    validateInt32(length, 'length', 0);
+    validateOffset(length, 'length');
   }
 
   const buffer = Buffer.allocUnsafe(length);
@@ -864,22 +867,22 @@ Buffer.prototype.compare = function compare(target,
   if (targetStart === undefined)
     targetStart = 0;
   else
-    validateInt32(targetStart, 'targetStart', 0);
+    validateOffset(targetStart, 'targetStart');
 
   if (targetEnd === undefined)
     targetEnd = target.length;
   else
-    validateInt32(targetEnd, 'targetEnd', 0, target.length);
+    validateOffset(targetEnd, 'targetEnd', 0, target.length);
 
   if (sourceStart === undefined)
     sourceStart = 0;
   else
-    validateInt32(sourceStart, 'sourceStart', 0);
+    validateOffset(sourceStart, 'sourceStart');
 
   if (sourceEnd === undefined)
     sourceEnd = this.length;
   else
-    validateInt32(sourceEnd, 'sourceEnd', 0, this.length);
+    validateOffset(sourceEnd, 'sourceEnd', 0, this.length);
 
   if (sourceStart >= sourceEnd)
     return (targetStart >= targetEnd ? 0 : -1);
@@ -1003,12 +1006,12 @@ function _fill(buf, value, offset, end, encoding) {
     offset = 0;
     end = buf.length;
   } else {
-    validateInt32(offset, 'offset', 0);
+    validateOffset(offset, 'offset');
     // Invalid ranges are not set to a default, so can range check early.
     if (end === undefined) {
       end = buf.length;
     } else {
-      validateInt32(end, 'end', 0, buf.length);
+      validateOffset(end, 'end', 0, buf.length);
     }
     if (offset >= end)
       return buf;
@@ -1048,7 +1051,7 @@ Buffer.prototype.write = function write(string, offset, length, encoding) {
 
   // Buffer#write(string, offset[, length][, encoding])
   } else {
-    validateInt32(offset, 'offset', 0, this.length);
+    validateOffset(offset, 'offset', 0, this.length);
 
     const remaining = this.length - offset;
 
@@ -1058,7 +1061,7 @@ Buffer.prototype.write = function write(string, offset, length, encoding) {
       encoding = length;
       length = remaining;
     } else {
-      validateInt32(length, 'length', 0, this.length);
+      validateOffset(length, 'length', 0, this.length);
       if (length > remaining)
         length = remaining;
     }