buffer: throw when writing beyond buffer"

This reverts commit dd8eeec. PR-URL: nodejs#54588 Refs: nodejs#54524 Reviewed-By: Matteo Collina <[email protected]> Reviewed-By: James M Snell <[email protected]>
Trott · Sep 28, 2024 · 3800d60 · 3800d60
1 parent e1d8b4f
commit 3800d60
Show file tree

Hide file tree

Showing 2 changed files with 19 additions and 6 deletions.
diff --git a/lib/internal/buffer.js b/lib/internal/buffer.js
@@ -1036,33 +1036,33 @@ function addBufferPrototypeMethods(proto) {
   proto.hexSlice = hexSlice;
   proto.ucs2Slice = ucs2Slice;
   proto.utf8Slice = utf8Slice;
-  proto.asciiWrite = function(string, offset = 0, length = this.byteLength) {
+  proto.asciiWrite = function(string, offset = 0, length = this.byteLength - offset) {
     if (offset < 0 || offset > this.byteLength) {
       throw new ERR_BUFFER_OUT_OF_BOUNDS('offset');
     }
-    if (length < 0) {
+    if (length < 0 || length > this.byteLength - offset) {
       throw new ERR_BUFFER_OUT_OF_BOUNDS('length');
     }
     return asciiWriteStatic(this, string, offset, length);
   };
   proto.base64Write = base64Write;
   proto.base64urlWrite = base64urlWrite;
-  proto.latin1Write = function(string, offset = 0, length = this.byteLength) {
+  proto.latin1Write = function(string, offset = 0, length = this.byteLength - offset) {
     if (offset < 0 || offset > this.byteLength) {
       throw new ERR_BUFFER_OUT_OF_BOUNDS('offset');
     }
-    if (length < 0) {
+    if (length < 0 || length > this.byteLength - offset) {
       throw new ERR_BUFFER_OUT_OF_BOUNDS('length');
     }
     return latin1WriteStatic(this, string, offset, length);
   };
   proto.hexWrite = hexWrite;
   proto.ucs2Write = ucs2Write;
-  proto.utf8Write = function(string, offset = 0, length = this.byteLength) {
+  proto.utf8Write = function(string, offset = 0, length = this.byteLength - offset) {
     if (offset < 0 || offset > this.byteLength) {
       throw new ERR_BUFFER_OUT_OF_BOUNDS('offset');
     }
-    if (length < 0) {
+    if (length < 0 || length > this.byteLength - offset) {
       throw new ERR_BUFFER_OUT_OF_BOUNDS('length');
     }
     return utf8WriteStatic(this, string, offset, length);

diff --git a/test/parallel/test-buffer-write.js b/test/parallel/test-buffer-write.js
@@ -121,3 +121,16 @@ assert.throws(() => {
 }, common.expectsError({
   code: 'ERR_BUFFER_OUT_OF_BOUNDS',
 }));
+
+
+assert.throws(() => {
+  Buffer.alloc(1).asciiWrite('ww', 0, 2);
+}, common.expectsError({
+  code: 'ERR_BUFFER_OUT_OF_BOUNDS',
+}));
+
+assert.throws(() => {
+  Buffer.alloc(1).asciiWrite('ww', 1, 1);
+}, common.expectsError({
+  code: 'ERR_BUFFER_OUT_OF_BOUNDS',
+}));