From c70c96a3e2a1c4bf305c07b272f5275ccc0e69c2 Mon Sep 17 00:00:00 2001
From: cjihrig <cjihrig@gmail.com>
Date: Fri, 28 Oct 2016 10:35:58 -0400
Subject: [PATCH] buffer: coerce offset using Math.trunc()

This is a partial revert of
14d1a8a631a58408f1e85365a5f2aaa047cc0a5f, which coerced the offset
of Buffer#slice() using the | operator. This causes some edge
cases to be handled incorrectly. This commit restores the old
behavior, but converts offsets to integers using Math.trunc().
This commit does not revert any tests, and adds an additional
regression test.

Refs: https://github.com/nodejs/node/issues/9096
Refs: https://github.com/nodejs/node/pull/9101
PR-URL: https://github.com/nodejs/node/pull/9341
Reviewed-By: Sakthipriyan Vairamani <thechargingvolcano@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Brian White <mscdex@mscdex.net>
Reviewed-By: Trevor Norris <trev.norris@gmail.com>
---
 lib/buffer.js                      |  6 ++++--
 test/parallel/test-buffer-slice.js | 27 +++++++++++++++++++++++++++
 2 files changed, 31 insertions(+), 2 deletions(-)

diff --git a/lib/buffer.js b/lib/buffer.js
index 9754cfeeb50b94..b2325098bcbb9d 100644
--- a/lib/buffer.js
+++ b/lib/buffer.js
@@ -807,8 +807,10 @@ Buffer.prototype.toJSON = function() {
 
 
 function adjustOffset(offset, length) {
-  offset |= 0;
-  if (offset === 0) {
+  // Use Math.trunc() to convert offset to an integer value that can be larger
+  // than an Int32. Hence, don't use offset | 0 or similar techniques.
+  offset = Math.trunc(offset);
+  if (offset === 0 || Number.isNaN(offset)) {
     return 0;
   } else if (offset < 0) {
     offset += length;
diff --git a/test/parallel/test-buffer-slice.js b/test/parallel/test-buffer-slice.js
index e5b598e62519e7..076bf33fb07736 100644
--- a/test/parallel/test-buffer-slice.js
+++ b/test/parallel/test-buffer-slice.js
@@ -72,3 +72,30 @@ assert.strictEqual(0, Buffer.from('hello').slice(0, 0).length);
     'bcd'
   );
 }
+
+{
+  const buf = Buffer.from('abcdefg');
+  assert.strictEqual(buf.slice(-(-1 >>> 0) - 1).toString(), buf.toString());
+}
+
+{
+  const buf = Buffer.from('abc');
+  assert.strictEqual(buf.slice(-0.5).toString(), buf.toString());
+}
+
+{
+  const buf = Buffer.from([
+    1, 29, 0, 0, 1, 143, 216, 162, 92, 254, 248, 63, 0,
+    0, 0, 18, 184, 6, 0, 175, 29, 0, 8, 11, 1, 0, 0
+  ]);
+  const chunk1 = Buffer.from([
+    1, 29, 0, 0, 1, 143, 216, 162, 92, 254, 248, 63, 0
+  ]);
+  const chunk2 = Buffer.from([
+    0, 0, 18, 184, 6, 0, 175, 29, 0, 8, 11, 1, 0, 0
+  ]);
+  const middle = buf.length / 2;
+
+  assert.deepStrictEqual(buf.slice(0, middle), chunk1);
+  assert.deepStrictEqual(buf.slice(middle), chunk2);
+}