Skip to content

Commit

Permalink
buffer: fix writeInt{B,L}E for some neg values
Browse files Browse the repository at this point in the history
The algorithm used to convert negative values to hex generates incorrect
values when the low byte(s) of the value are zero because a carried
subtraction is applied prematurely.

Fixes: #3992
PR-URL: #3994
Reviewed-By: Trevor Norris <[email protected]>
Signed-off-by: Peter A. Bigot <[email protected]>
  • Loading branch information
pabigot authored and rvagg committed Dec 5, 2015
1 parent 4302648 commit 0e18e68
Show file tree
Hide file tree
Showing 2 changed files with 40 additions and 4 deletions.
14 changes: 10 additions & 4 deletions lib/buffer.js
Original file line number Diff line number Diff line change
Expand Up @@ -939,10 +939,13 @@ Buffer.prototype.writeIntLE = function(value, offset, byteLength, noAssert) {

var i = 0;
var mul = 1;
var sub = value < 0 ? 1 : 0;
var sub = 0;
this[offset] = value;
while (++i < byteLength && (mul *= 0x100))
while (++i < byteLength && (mul *= 0x100)) {
if (value < 0 && sub === 0 && this[offset + i - 1] !== 0)
sub = 1;
this[offset + i] = ((value / mul) >> 0) - sub;
}

return offset + byteLength;
};
Expand All @@ -962,10 +965,13 @@ Buffer.prototype.writeIntBE = function(value, offset, byteLength, noAssert) {

var i = byteLength - 1;
var mul = 1;
var sub = value < 0 ? 1 : 0;
var sub = 0;
this[offset + i] = value;
while (--i >= 0 && (mul *= 0x100))
while (--i >= 0 && (mul *= 0x100)) {
if (value < 0 && sub === 0 && this[offset + i + 1] !== 0)
sub = 1;
this[offset + i] = ((value / mul) >> 0) - sub;
}

return offset + byteLength;
};
Expand Down
30 changes: 30 additions & 0 deletions test/parallel/test-buffer.js
Original file line number Diff line number Diff line change
Expand Up @@ -1027,6 +1027,26 @@ assert.equal(buf.readInt8(0), -1);
assert.deepEqual(buf.toJSON().data, [0xed, 0xcb, 0xaa]);
assert.equal(buf.readIntBE(0, 3), -0x123456);

buf = new Buffer(3);
buf.writeIntLE(-0x123400, 0, 3);
assert.deepEqual(buf.toJSON().data, [0x00, 0xcc, 0xed]);
assert.equal(buf.readIntLE(0, 3), -0x123400);

buf = new Buffer(3);
buf.writeIntBE(-0x123400, 0, 3);
assert.deepEqual(buf.toJSON().data, [0xed, 0xcc, 0x00]);
assert.equal(buf.readIntBE(0, 3), -0x123400);

buf = new Buffer(3);
buf.writeIntLE(-0x120000, 0, 3);
assert.deepEqual(buf.toJSON().data, [0x00, 0x00, 0xee]);
assert.equal(buf.readIntLE(0, 3), -0x120000);

buf = new Buffer(3);
buf.writeIntBE(-0x120000, 0, 3);
assert.deepEqual(buf.toJSON().data, [0xee, 0x00, 0x00]);
assert.equal(buf.readIntBE(0, 3), -0x120000);

buf = new Buffer(5);
buf.writeUIntLE(0x1234567890, 0, 5);
assert.deepEqual(buf.toJSON().data, [0x90, 0x78, 0x56, 0x34, 0x12]);
Expand Down Expand Up @@ -1056,6 +1076,16 @@ assert.equal(buf.readInt8(0), -1);
buf.writeIntBE(-0x1234567890, 0, 5);
assert.deepEqual(buf.toJSON().data, [0xed, 0xcb, 0xa9, 0x87, 0x70]);
assert.equal(buf.readIntBE(0, 5), -0x1234567890);

buf = new Buffer(5);
buf.writeIntLE(-0x0012000000, 0, 5);
assert.deepEqual(buf.toJSON().data, [0x00, 0x00, 0x00, 0xee, 0xff]);
assert.equal(buf.readIntLE(0, 5), -0x0012000000);

buf = new Buffer(5);
buf.writeIntBE(-0x0012000000, 0, 5);
assert.deepEqual(buf.toJSON().data, [0xff, 0xee, 0x00, 0x00, 0x00]);
assert.equal(buf.readIntBE(0, 5), -0x0012000000);
})();

// test Buffer slice
Expand Down

0 comments on commit 0e18e68

Please sign in to comment.