diff --git a/src/node_buffer.cc b/src/node_buffer.cc index 0e4d437c1ea501..967f1964573c88 100644 --- a/src/node_buffer.cc +++ b/src/node_buffer.cc @@ -578,9 +578,27 @@ void CopyImpl(Local source_obj, void SlowCopy(const FunctionCallbackInfo& args) { Local source_obj = args[0]; Local target_obj = args[1]; + Isolate* isolate = args.GetIsolate(); + + // Add validation before call CopyImpl blindly + if (!source_obj->IsArrayBufferView() || !target_obj->IsArrayBufferView()) { + isolate->ThrowException(v8::Exception::TypeError( + String::NewFromUtf8Literal(isolate, "Arguments must be ArrayBufferViews"))); + return; + } const uint32_t target_start = args[2].As()->Value(); const uint32_t source_start = args[3].As()->Value(); const uint32_t to_copy = args[4].As()->Value(); + size_t source_len = source_obj.As()->ByteLength(); + size_t target_len = target_obj.As()->ByteLength(); + + if (source_start > source_len || target_start > target_len || + to_copy > source_len - source_start || + to_copy > target_len - target_start) { + isolate->ThrowException(v8::Exception::RangeError( + String::NewFromUtf8Literal(isolate, "Buffer copy out of range"))); + return; + } CopyImpl(source_obj, target_obj, target_start, source_start, to_copy); @@ -588,7 +606,7 @@ void SlowCopy(const FunctionCallbackInfo& args) { } // Assume caller has properly validated args. -uint32_t FastCopy(Local receiver, +int32_t FastCopy(Local receiver, Local source_obj, Local target_obj, uint32_t target_start, @@ -597,7 +615,21 @@ uint32_t FastCopy(Local receiver, // NOLINTNEXTLINE(runtime/references) FastApiCallbackOptions& options) { HandleScope scope(options.isolate); + Isolate* isolate = options.isolate; + if (!source_obj->IsArrayBufferView() || !target_obj->IsArrayBufferView()) { + isolate->ThrowException(v8::Exception::TypeError( + String::NewFromUtf8Literal(isolate, "Arguments must be ArrayBufferViews"))); + return 0; + } + // Validate First before call CopyImpl blindly + size_t src_len = source_obj.As()->ByteLength(); + size_t dst_len = target_obj.As()->ByteLength(); + + if (source_start > src_len || target_start > dst_len || + to_copy > src_len - source_start || to_copy > dst_len - target_start) { + return -1; + } CopyImpl(source_obj, target_obj, target_start, source_start, to_copy); return to_copy;