Commit 14d1a8a6 authored by Sakthipriyan Vairamani (thefourtheye)'s avatar Sakthipriyan Vairamani (thefourtheye) Committed by James M Snell
Browse files

buffer: coerce slice parameters consistently

As shown in https://github.com/nodejs/node/issues/9096, the offset and
end value of the `slice` call are coerced to numbers and then passed to
`FastBuffer`, which internally truncates the mantissa part if the number
is actually a floating point number. This actually affects the new
length of the slice calculation. For example,

    > const original = Buffer.from('abcd');
    undefined
    > original.slice(original.length / 3).toString()
    'bc'

This happens because, starting value of the slice is 4 / 3, which is
1.33 (approximately). Now, the length of the slice is calculated as
the difference between the actual length of the buffer and the starting
offset. So, it becomes 2.67 (4 - 1.33). Now, a new `FastBuffer` is
constructed, with the following values as parameters,

 1. actual buffer object,
 2. starting value, which is 1.33 and
 3. the length 2.67.

The underlying C++ code truncates the numbers and they become 1 and 2.
That is why the result is just `bc`.

This patch makes sure that all the offsets are coerced to integers
before any calculations are done.

Fixes: https://github.com/nodejs/node/issues/9096
PR-URL: https://github.com/nodejs/node/pull/9101


Reviewed-By: default avatarJames M Snell <jasnell@gmail.com>
Reviewed-By: default avatarMichaël Zasso <targos@protonmail.com>
Reviewed-By: default avatarAnna Henningsen <anna@addaleax.net>
Reviewed-By: default avatarFranziska Hinkelmann <franziska.hinkelmann@gmail.com>
Reviewed-By: default avatarColin Ihrig <cjihrig@gmail.com>
Reviewed-By: default avatarLuigi Pinca <luigipinca@gmail.com>
Reviewed-By: default avatarBrian White <mscdex@mscdex.net>
parent 8788d009
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment