From 9fea7eae9a48c6c2e8fb75204a4e5c60e700a3e2 Mon Sep 17 00:00:00 2001
From: Rich Trott <rtrott@gmail.com>
Date: Tue, 2 Jan 2018 16:10:57 -0800
Subject: buffer: check byteLength in readUInt(B|L)E
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

PR-URL: https://github.com/nodejs/node/pull/11146
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
---
 lib/buffer.js | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

(limited to 'lib')

diff --git a/lib/buffer.js b/lib/buffer.js
index cd08453c24..03f0cb3377 100644
--- a/lib/buffer.js
+++ b/lib/buffer.js
@@ -1040,8 +1040,10 @@ Buffer.prototype.readUIntLE =
   function readUIntLE(offset, byteLength, noAssert) {
     offset = offset >>> 0;
     byteLength = byteLength >>> 0;
-    if (!noAssert)
+    if (!noAssert) {
+      checkByteLength(byteLength);
       checkOffset(offset, byteLength, this.length);
+    }
 
     var val = this[offset];
     var mul = 1;
@@ -1057,8 +1059,10 @@ Buffer.prototype.readUIntBE =
   function readUIntBE(offset, byteLength, noAssert) {
     offset = offset >>> 0;
     byteLength = byteLength >>> 0;
-    if (!noAssert)
+    if (!noAssert) {
+      checkByteLength(byteLength);
       checkOffset(offset, byteLength, this.length);
+    }
 
     var val = this[offset + --byteLength];
     var mul = 1;
-- 
cgit v1.2.3