buffer: fix writeUInt16BE range check

Fixes: #24205

PR-URL: #24208
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>

Author: mscdex

lib/internal/buffer.js

@@ -658,7 +658,7 @@ function writeU_Int16BE(buf, value, offset, min, max) {
 }
 
 function writeUInt16BE(value, offset = 0) {
-  return writeU_Int16BE(this, value, offset, 0, 0xffffffff);
+  return writeU_Int16BE(this, value, offset, 0, 0xffff);
 }
 
 function writeIntLE(value, offset = 0, byteLength) {

test/parallel/test-buffer-writeuint.js

@@ -84,6 +84,18 @@ const assert = require('assert');
 
   data.writeUInt16BE(value, 0);
   assert.ok(data.equals(new Uint8Array([0xff, 0x80, 0x43, 0x23])));
+
+  value = 0xfffff;
+  ['writeUInt16BE', 'writeUInt16LE'].forEach((fn) => {
+    assert.throws(
+      () => data[fn](value, 0),
+      {
+        code: 'ERR_OUT_OF_RANGE',
+        message: 'The value of "value" is out of range. ' +
+                 `It must be >= 0 and <= 65535. Received ${value}`
+      }
+    );
+  });
 }
 
 // Test 32 bit