From 04b63e022a477ee042fec38628b1686cfdb9493b Mon Sep 17 00:00:00 2001
From: Ben Noordhuis <info@bnoordhuis.nl>
Date: Tue, 10 Feb 2015 13:56:05 -0700
Subject: [PATCH] lib: fix max size check in Buffer constructor

A number -> uint32 type coercion bug made buffer sizes
larger than kMaxLength (0x3fffffff) wrap around.

Instead of rejecting the requested size with an exception,
the constructor created a buffer with the wrong size.

PR-URL: https://github.com/iojs/io.js/pull/657
Reviewed-By: Trevor Norris <trev.norris@gmail.com>
---
 lib/buffer.js              | 10 +++++++---
 test/simple/test-buffer.js |  3 +++
 2 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/lib/buffer.js b/lib/buffer.js
index 2e29ae4eba7903..e5588963df4c4b 100644
--- a/lib/buffer.js
+++ b/lib/buffer.js
@@ -50,7 +50,7 @@ function Buffer(subject, encoding) {
     return new Buffer(subject, encoding);
 
   if (util.isNumber(subject)) {
-    this.length = subject > 0 ? subject >>> 0 : 0;
+    this.length = +subject;
 
   } else if (util.isString(subject)) {
     if (!util.isString(encoding) || encoding.length === 0)
@@ -61,8 +61,7 @@ function Buffer(subject, encoding) {
   } else if (util.isObject(subject)) {
     if (subject.type === 'Buffer' && util.isArray(subject.data))
       subject = subject.data;
-    // Must use floor() because array length may be > kMaxLength.
-    this.length = +subject.length > 0 ? Math.floor(+subject.length) : 0;
+    this.length = +subject.length;
 
   } else {
     throw new TypeError('must start with number, buffer, array or string');
@@ -73,6 +72,11 @@ function Buffer(subject, encoding) {
                          'size: 0x' + kMaxLength.toString(16) + ' bytes');
   }
 
+  if (this.length < 0)
+    this.length = 0;
+  else
+    this.length >>>= 0;  // Coerce to uint32.
+
   this.parent = undefined;
   if (this.length <= (Buffer.poolSize >>> 1) && this.length > 0) {
     if (this.length > poolSize - poolOffset)
diff --git a/test/simple/test-buffer.js b/test/simple/test-buffer.js
index bf742f93480934..0b3052db98f2c4 100644
--- a/test/simple/test-buffer.js
+++ b/test/simple/test-buffer.js
@@ -1184,3 +1184,6 @@ assert.throws(function() {
   var b = new Buffer(1);
   b.equals('abc');
 });
+
+// Regression test for https://github.com/iojs/io.js/issues/649.
+assert.throws(function() { Buffer(1422561062959).toString('utf8'); });