From f0d43929f215632764eb140f3308589802e26066 Mon Sep 17 00:00:00 2001 From: Brian White Date: Tue, 12 Nov 2019 22:41:12 -0500 Subject: [PATCH] buffer: fix 6-byte writeUIntBE() range check Fixes: https://github.com/nodejs/node/issues/30420 PR-URL: https://github.com/nodejs/node/pull/30459 Reviewed-By: Anna Henningsen Reviewed-By: David Carlier Reviewed-By: Colin Ihrig Reviewed-By: Ruben Bridgewater Reviewed-By: James M Snell --- lib/internal/buffer.js | 2 +- test/parallel/test-buffer-writeint.js | 2 +- test/parallel/test-buffer-writeuint.js | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/lib/internal/buffer.js b/lib/internal/buffer.js index f3bc0e48d1c911..acd7d319d5e1b2 100644 --- a/lib/internal/buffer.js +++ b/lib/internal/buffer.js @@ -736,7 +736,7 @@ function writeUInt8(value, offset = 0) { function writeUIntBE(value, offset, byteLength) { if (byteLength === 6) - return writeU_Int48BE(this, value, offset, 0, 0xffffffffffffff); + return writeU_Int48BE(this, value, offset, 0, 0xffffffffffff); if (byteLength === 5) return writeU_Int40BE(this, value, offset, 0, 0xffffffffff); if (byteLength === 3) diff --git a/test/parallel/test-buffer-writeint.js b/test/parallel/test-buffer-writeint.js index 05b0cd1ebbfada..0e812cc8886941 100644 --- a/test/parallel/test-buffer-writeint.js +++ b/test/parallel/test-buffer-writeint.js @@ -213,7 +213,7 @@ const errorOutOfBounds = common.expectsError({ }); // Test 1 to 6 bytes. - for (let i = 1; i < 6; i++) { + for (let i = 1; i <= 6; i++) { ['writeIntBE', 'writeIntLE'].forEach((fn) => { const min = -(2 ** (i * 8 - 1)); const max = 2 ** (i * 8 - 1) - 1; diff --git a/test/parallel/test-buffer-writeuint.js b/test/parallel/test-buffer-writeuint.js index 3823b74d565519..c7708d663eca80 100644 --- a/test/parallel/test-buffer-writeuint.js +++ b/test/parallel/test-buffer-writeuint.js @@ -170,7 +170,7 @@ const assert = require('assert'); }); // Test 1 to 6 bytes. - for (let i = 1; i < 6; i++) { + for (let i = 1; i <= 6; i++) { const range = i < 5 ? `= ${val - 1}` : ` 2 ** ${i * 8}`; const received = i > 4 ? String(val).replace(/(\d)(?=(\d\d\d)+(?!\d))/g, '$1_') :