buffer: fix out of range for toString

Co-authored-by: Michaël Zasso <[email protected]> PR-URL: #54553 Fixes: #52298 Reviewed-By: James M Snell <[email protected]> Reviewed-By: Jake Yuesong Li <[email protected]>
nodejs · Oct 2, 2024 · 8eecdb8 · 8eecdb8
1 parent b54b3cc
commit 8eecdb8
Show file tree

Hide file tree

Showing 2 changed files with 11 additions and 3 deletions.
diff --git a/lib/buffer.js b/lib/buffer.js
@@ -841,12 +841,12 @@ Buffer.prototype.toString = function toString(encoding, start, end) {
   else if (start >= len)
     return '';
   else
-    start |= 0;
+    start = MathTrunc(start) || 0;
 
   if (end === undefined || end > len)
     end = len;
   else
-    end |= 0;
+    end = MathTrunc(end) || 0;
 
   if (end <= start)
     return '';

diff --git a/test/parallel/test-buffer-tostring-range.js b/test/parallel/test-buffer-tostring-range.js
@@ -1,6 +1,6 @@
 'use strict';
 
-require('../common');
+const common = require('../common');
 const assert = require('assert');
 
 const rangeBuffer = Buffer.from('abc');
@@ -98,3 +98,11 @@ assert.throws(() => {
   name: 'TypeError',
   message: 'Unknown encoding: null'
 });
+
+// Must not throw when start and end are within kMaxLength
+// Cannot test on 32bit machine as we are testing the case
+// when start and end are above the threshold
+common.skipIf32Bits();
+const threshold = 0xFFFFFFFF;
+const largeBuffer = Buffer.alloc(threshold);
+largeBuffer.toString('utf8', threshold + 0xF, threshold + 0xFF);