From e953dffb3bc01bd64cd40e8aa397d546c6320d3f Mon Sep 17 00:00:00 2001
From: Anna Henningsen <anna@addaleax.net>
Date: Wed, 9 Sep 2020 23:11:21 +0200
Subject: [PATCH] buffer: adjust validation to account for buffer.kMaxLength

---
 lib/buffer.js | 23 +++++++++++++----------
 1 file changed, 13 insertions(+), 10 deletions(-)

diff --git a/lib/buffer.js b/lib/buffer.js
index 4119dd55eaacb7..4ff9c73dfac7de 100644
--- a/lib/buffer.js
+++ b/lib/buffer.js
@@ -94,9 +94,12 @@ const {
 } = require('internal/errors');
 const {
   validateBuffer,
-  validateInt32,
+  validateInteger,
   validateString
 } = require('internal/validators');
+// Provide validateInteger() but with kMaxLength as the default maximum value.
+const validateOffset = (value, name, min = 0, max = kMaxLength) =>
+  validateInteger(value, name, min, max);
 
 const {
   FastBuffer,
@@ -542,7 +545,7 @@ Buffer.concat = function concat(list, length) {
       }
     }
   } else {
-    validateInt32(length, 'length', 0);
+    validateOffset(length, 'length');
   }
 
   const buffer = Buffer.allocUnsafe(length);
@@ -849,22 +852,22 @@ Buffer.prototype.compare = function compare(target,
   if (targetStart === undefined)
     targetStart = 0;
   else
-    validateInt32(targetStart, 'targetStart', 0);
+    validateOffset(targetStart, 'targetStart');
 
   if (targetEnd === undefined)
     targetEnd = target.length;
   else
-    validateInt32(targetEnd, 'targetEnd', 0, target.length);
+    validateOffset(targetEnd, 'targetEnd', 0, target.length);
 
   if (sourceStart === undefined)
     sourceStart = 0;
   else
-    validateInt32(sourceStart, 'sourceStart', 0);
+    validateOffset(sourceStart, 'sourceStart');
 
   if (sourceEnd === undefined)
     sourceEnd = this.length;
   else
-    validateInt32(sourceEnd, 'sourceEnd', 0, this.length);
+    validateOffset(sourceEnd, 'sourceEnd', 0, this.length);
 
   if (sourceStart >= sourceEnd)
     return (targetStart >= targetEnd ? 0 : -1);
@@ -988,12 +991,12 @@ function _fill(buf, value, offset, end, encoding) {
     offset = 0;
     end = buf.length;
   } else {
-    validateInt32(offset, 'offset', 0);
+    validateOffset(offset, 'offset');
     // Invalid ranges are not set to a default, so can range check early.
     if (end === undefined) {
       end = buf.length;
     } else {
-      validateInt32(end, 'end', 0, buf.length);
+      validateOffset(end, 'end', 0, buf.length);
     }
     if (offset >= end)
       return buf;
@@ -1033,7 +1036,7 @@ Buffer.prototype.write = function write(string, offset, length, encoding) {
 
   // Buffer#write(string, offset[, length][, encoding])
   } else {
-    validateInt32(offset, 'offset', 0, this.length);
+    validateOffset(offset, 'offset', 0, this.length);
 
     const remaining = this.length - offset;
 
@@ -1043,7 +1046,7 @@ Buffer.prototype.write = function write(string, offset, length, encoding) {
       encoding = length;
       length = remaining;
     } else {
-      validateInt32(length, 'length', 0, this.length);
+      validateOffset(length, 'length', 0, this.length);
       if (length > remaining)
         length = remaining;
     }