buffer: ignore negative allocation lengths

addaleax · Myles Borins · commit ee2f08fe51a8 · 2016-07-11T14:30:12.000-07:00
Treat negative length arguments to `Buffer()`/`allocUnsafe()` as if they were zero so the allocation does not affect the pool’s offset. Fixes: #7047 Refs: #7051 Refs: #7221 Refs: #7475 PR-URL: #7562 Reviewed-By: Trevor Norris <trev.norris@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Nikolai Vavilov <vvnicholas@gmail.com>
diff --git a/lib/buffer.js b/lib/buffer.js
@@ -79,8 +79,8 @@ Object.setPrototypeOf(SlowBuffer, Uint8Array);
 
 
 function allocate(size) {
-  if (size === 0) {
-    return createBuffer(size);
+  if (size <= 0) {
+    return createBuffer(0);
   }
   if (size < (Buffer.poolSize >>> 1)) {
     if (size > (poolSize - poolOffset))

Original file line number	Diff line number	Diff line change
`@@ -79,8 +79,8 @@ Object.setPrototypeOf(SlowBuffer, Uint8Array);`
`79`	`79`
`80`	`80`
`81`	`81`	`function allocate(size) {`
`82`		`- if (size === 0) {`
`83`		`- return createBuffer(size);`
	`82`	`+ if (size <= 0) {`
	`83`	`+ return createBuffer(0);`
`84`	`84`	`}`
`85`	`85`	`if (size < (Buffer.poolSize >>> 1)) {`
`86`	`86`	`if (size > (poolSize - poolOffset))`