buffer: validate args to copy

nodejs · Oct 25, 2018 · aeaa698 · aeaa698
1 parent 24cb1f3
commit aeaa698
Show file tree

Hide file tree

Showing 3 changed files with 77 additions and 6 deletions.
diff --git a/lib/buffer.js b/lib/buffer.js
@@ -624,10 +624,30 @@ function stringSlice(buf, encoding, start, end) {
   throw new ERR_UNKNOWN_ENCODING(encoding);
 }
 
-Buffer.prototype.copy =
-  function copy(target, targetStart, sourceStart, sourceEnd) {
-    return _copy(this, target, targetStart, sourceStart, sourceEnd);
-  };
+function validateOffsetType(val, name) {
+  if (val) {
+    if (typeof val !== 'number') {
+      throw new ERR_INVALID_ARG_TYPE(name, ['Number'], val);
+    }
+    if (val < 0) {
+      throw new ERR_OUT_OF_RANGE(name, '>= 0', val);
+    }
+  } else {
+    val = 0;
+  }
+  return val;
+}
+
+Buffer.prototype.copy = function(target, targetStart, sourceStart, sourceEnd) {
+  if (!isUint8Array(target)) {
+    throw new ERR_INVALID_ARG_TYPE(
+      'otherBuffer', ['Buffer', 'Uint8Array'], target);
+  }
+  targetStart = validateOffsetType(targetStart, 'targetStart');
+  sourceStart = validateOffsetType(sourceStart, 'sourceStart');
+  sourceEnd = validateOffsetType(sourceEnd, 'sourceEnd') || this.length;
+  return _copy(this, target, targetStart, sourceStart, sourceEnd);
+};
 
 // No need to verify that "buf.length <= MAX_UINT32" since it's a read-only
 // property of a typed array.

diff --git a/test/parallel/test-buffer-alloc.js b/test/parallel/test-buffer-alloc.js
@@ -964,7 +964,8 @@ common.expectsError(
   {
     code: 'ERR_INVALID_ARG_TYPE',
     type: TypeError,
-    message: 'argument must be a buffer'
+    message: 'The "otherBuffer" argument must be one of type Buffer or ' +
+    'Uint8Array. Received type undefined'
   });
 
 assert.throws(() => Buffer.from(), {

diff --git a/test/parallel/test-buffer-copy.js b/test/parallel/test-buffer-copy.js
@@ -1,6 +1,6 @@
 'use strict';
 
-require('../common');
+const common = require('../common');
 const assert = require('assert');
 
 const b = Buffer.allocUnsafe(1024);
@@ -144,3 +144,53 @@ assert.strictEqual(b.copy(c, 512, 0, 10), 0);
     assert.strictEqual(c[i], e[i]);
   }
 }
+
+
+// Validate arg type checking.
+// Refs: https://github.com/nodejs/node/issues/23668
+{
+  common.expectsError(
+    () => b.copy(c, '1'),
+    {
+      code: 'ERR_INVALID_ARG_TYPE',
+      type: TypeError,
+      message: 'The "targetStart" argument must be of type ' +
+        'Number. Received type string'
+    }
+  );
+  common.expectsError(
+    () => b.copy(c, 0, '1'),
+    {
+      code: 'ERR_INVALID_ARG_TYPE',
+      type: TypeError,
+      message: 'The "sourceStart" argument must be of type ' +
+        'Number. Received type string'
+    }
+  );
+  common.expectsError(
+    () => b.copy(c, 0, 0, '1'),
+    {
+      code: 'ERR_INVALID_ARG_TYPE',
+      type: TypeError,
+      message: 'The "sourceEnd" argument must be of type ' +
+        'Number. Received type string'
+    }
+  );
+}
+
+// Validate arg range checking.
+// Refs: https://github.com/nodejs/node/issues/23668
+{
+  common.expectsError(
+    () => b.copy(c, -1),
+    RangeError
+  );
+  common.expectsError(
+    () => b.copy(c, 0, -1),
+    RangeError
+  );
+  common.expectsError(
+    () => b.copy(c, 0, 0, -1),
+    RangeError
+  );
+}