Skip to content

Commit 3b23094

Browse files
committed
fixup! dgram: fix send with out of bounds offset + length
1 parent 63a0887 commit 3b23094

File tree

2 files changed

+17
-46
lines changed

2 files changed

+17
-46
lines changed

lib/dgram.js

Lines changed: 6 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -40,9 +40,9 @@ const {
4040
} = require('internal/dgram');
4141
const { guessHandleType } = internalBinding('util');
4242
const {
43+
ERR_BUFFER_OUT_OF_BOUNDS,
4344
ERR_INVALID_ARG_TYPE,
4445
ERR_MISSING_ARGS,
45-
ERR_OUT_OF_RANGE,
4646
ERR_SOCKET_ALREADY_BOUND,
4747
ERR_SOCKET_BAD_BUFFER_SIZE,
4848
ERR_SOCKET_BUFFER_SIZE,
@@ -488,17 +488,12 @@ function sliceBuffer(buffer, offset, length) {
488488

489489
offset = offset >>> 0;
490490
length = length >>> 0;
491+
if (offset > buffer.byteLength) {
492+
throw new ERR_BUFFER_OUT_OF_BOUNDS('offset');
493+
}
491494

492-
// TypedArray and DataView bounds are checked in Buffer.from
493-
if (Buffer.isBuffer(buffer)) {
494-
if (offset > buffer.byteLength) {
495-
throw new ERR_OUT_OF_RANGE('offset', `<= ${buffer.byteLength}`, offset);
496-
}
497-
498-
if (offset + length > buffer.byteLength) {
499-
throw new ERR_OUT_OF_RANGE('length',
500-
`<= ${buffer.byteLength - offset}`, length);
501-
}
495+
if (offset + length > buffer.byteLength) {
496+
throw new ERR_BUFFER_OUT_OF_BOUNDS('length');
502497
}
503498

504499
return Buffer.from(buffer.buffer, buffer.byteOffset + offset, length);

test/parallel/test-dgram-send-bad-arguments.js

Lines changed: 11 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -78,43 +78,19 @@ function checkArgs(connected) {
7878
}
7979
);
8080

81-
for (const input of ['hello', Buffer.from('hello'),
81+
for (const input of [
82+
'hello',
83+
Buffer.from('hello'),
8284
Buffer.from('hello world').subarray(0, 5),
83-
Buffer.from('hello world').subarray(6)]) {
84-
assert.throws(
85-
() => { sock.send(input, 6, 0); },
86-
{
87-
code: 'ERR_OUT_OF_RANGE',
88-
name: 'RangeError',
89-
message: 'The value of "offset" is out of range. ' +
90-
'It must be <= 5. Received 6'
91-
}
92-
);
93-
94-
assert.throws(
95-
() => { sock.send(input, 0, 6); },
96-
{
97-
code: 'ERR_OUT_OF_RANGE',
98-
name: 'RangeError',
99-
message: 'The value of "length" is out of range. ' +
100-
'It must be <= 5. Received 6'
101-
}
102-
);
103-
104-
assert.throws(
105-
() => { sock.send(input, 3, 4); },
106-
{
107-
code: 'ERR_OUT_OF_RANGE',
108-
name: 'RangeError',
109-
message: 'The value of "length" is out of range. ' +
110-
'It must be <= 2. Received 4'
111-
}
112-
);
113-
}
114-
115-
for (const input of [new Uint8Array([1, 2, 3, 4, 5]),
85+
Buffer.from('hello world').subarray(4, 9),
86+
Buffer.from('hello world').subarray(6),
87+
new Uint8Array([1, 2, 3, 4, 5]),
88+
new Uint8Array([1, 2, 3, 4, 5, 6, 7, 8]).slice(0, 5),
89+
new Uint8Array([1, 2, 3, 4, 5, 6, 7, 8]).slice(2, 7),
90+
new Uint8Array([1, 2, 3, 4, 5, 6, 7, 8]).slice(3),
11691
new DataView(new ArrayBuffer(5), 0),
117-
new DataView(new ArrayBuffer(6), 2)]) {
92+
new DataView(new ArrayBuffer(6), 1),
93+
new DataView(new ArrayBuffer(7), 1, 5)]) {
11894
assert.throws(
11995
() => { sock.send(input, 6, 0); },
12096
{

0 commit comments

Comments
 (0)