From: Trevor Norris <trev.norris@gmail.com>
Date: Mon, 26 Aug 2013 10:26:31 +0000 (-0700)
Subject: buffer: fix assert fail from JS API
X-Git-Tag: v0.11.7~52
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=873b5f8428fccd7cb73378fff951a08d9aab4e91;p=platform%2Fupstream%2Fnodejs.git

buffer: fix assert fail from JS API

Length arguments passed to SlowBuffer were coerced to Int32, not Uint32,
so passing a negative number would throw the following:

node: ../src/smalloc.cc:244: void node::smalloc::Alloc(): Assertion `length <= kMaxLength' failed.
Aborted (core dumped)

That has been fixed by coercing to Uint32 and comparing the value
against kMaxLength.
---

diff --git a/lib/buffer.js b/lib/buffer.js
index fc6b657..dfd79e6 100644
--- a/lib/buffer.js
+++ b/lib/buffer.js
@@ -89,7 +89,9 @@ function Buffer(subject, encoding) {
 
 
 function SlowBuffer(length) {
-  length = ~~length;
+  length = length >>> 0;
+  if (length > kMaxLength)
+    throw new RangeError('length > kMaxLength');
   var b = new NativeBuffer(length);
   alloc(b, length);
   return b;