Merge remote-tracking branch 'ry/v0.8' into master

Conflicts:
	AUTHORS
	ChangeLog
	src/node_version.h
	test/simple/test-buffer.js

1 files changed, 13 insertions, 0 deletions

diff --git a/src/node_buffer.cc b/src/node_buffer.cc
index ed2656955a..58f83d8d59 100644
--- a/src/node_buffer.cc
+++ b/src/node_buffer.cc
@@ -857,6 +857,19 @@ Handle<Value> Buffer::MakeFastBuffer(const Arguments &args) {
   uint32_t offset = args[2]->Uint32Value();
   uint32_t length = args[3]->Uint32Value();
 
+  if (offset > buffer->length_) {
+    return ThrowRangeError("offset out of range");
+  }
+
+  if (offset + length > buffer->length_) {
+    return ThrowRangeError("length out of range");
+  }
+
+  // Check for wraparound. Safe because offset and length are unsigned.
+  if (offset + length < offset) {
+    return ThrowRangeError("offset or length out of range");
+  }
+
   fast_buffer->SetIndexedPropertiesToExternalArrayData(buffer->data_ + offset,
                                                        kExternalUnsignedByteArray,
                                                        length);