From: Łukasz Walukiewicz <lukasz@walukiewicz.eu>
Date: Fri, 5 Apr 2013 14:48:18 +0000 (+0200)
Subject: buffer: fix offset checks
X-Git-Tag: v0.10.4~10
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=2e28832660099b49d861f4d4039d8d35ebb6c77e;p=platform%2Fupstream%2Fnodejs.git

buffer: fix offset checks

Fixed offset checks in Buffer.readInt32LE() and Buffer.readInt32BE()
functions.
---

diff --git a/lib/buffer.js b/lib/buffer.js
index 3378dcebf..c75dbc93a 100644
--- a/lib/buffer.js
+++ b/lib/buffer.js
@@ -737,14 +737,14 @@ function readInt32(buffer, offset, isBigEndian) {
 
 Buffer.prototype.readInt32LE = function(offset, noAssert) {
   if (!noAssert)
-    checkOffset(offset, 2, this.length);
+    checkOffset(offset, 4, this.length);
   return readInt32(this, offset, false);
 };
 
 
 Buffer.prototype.readInt32BE = function(offset, noAssert) {
   if (!noAssert)
-    checkOffset(offset, 2, this.length);
+    checkOffset(offset, 4, this.length);
   return readInt32(this, offset, true);
 };
 
diff --git a/test/simple/test-buffer.js b/test/simple/test-buffer.js
index b0ab6ed53..cd9096de5 100644
--- a/test/simple/test-buffer.js
+++ b/test/simple/test-buffer.js
@@ -908,6 +908,39 @@ assert.throws(function() {
   buf.writeFloatLE(0.0, -1);
 }, /offset is not uint/);
 
+// offset checks
+var buf = new Buffer(0);
+
+assert.throws(function() { buf.readUInt8(0); }, /beyond buffer length/);
+assert.throws(function() { buf.readInt8(0); }, /beyond buffer length/);
+
+[16, 32].forEach(function(bits) {
+  var buf = new Buffer(bits / 8 - 1);
+
+  assert.throws(
+    function() { buf['readUInt' + bits + 'BE'](0); },
+    /beyond buffer length/,
+    'readUInt' + bits + 'BE'
+  );
+
+  assert.throws(
+    function() { buf['readUInt' + bits + 'LE'](0); },
+    /beyond buffer length/,
+    'readUInt' + bits + 'LE'
+  );
+
+  assert.throws(
+    function() { buf['readInt' + bits + 'BE'](0); },
+    /beyond buffer length/,
+    'readInt' + bits + 'BE()'
+  );
+
+  assert.throws(
+    function() { buf['readInt' + bits + 'LE'](0); },
+    /beyond buffer length/,
+    'readInt' + bits + 'LE()'
+  );
+});
 
 // SlowBuffer sanity checks.
 assert.throws(function() {