From: Feross Aboukhadijeh <feross@feross.org>
Date: Tue, 10 Feb 2015 02:16:10 +0000 (-0800)
Subject: fix max size check in Buffer constructor
X-Git-Url: https://zoso.dev/?a=commitdiff_plain;h=f77fa929d89380c5add3fe48bb8fefed8dbfd1e8;p=buffer.git

fix max size check in Buffer constructor

Copied from https://github.com/iojs/io.js/pull/657
---

diff --git a/index.js b/index.js
index ae4b521..78f74f2 100644
--- a/index.js
+++ b/index.js
@@ -73,13 +73,13 @@ function Buffer (subject, encoding, noZero) {
   // Find the length
   var length
   if (type === 'number')
-    length = subject > 0 ? subject >>> 0 : 0
+    length = +subject
   else if (type === 'string') {
     length = Buffer.byteLength(subject, encoding)
   } else if (type === 'object' && subject !== null) { // assume object is array-like
     if (subject.type === 'Buffer' && isArray(subject.data))
       subject = subject.data
-    length = +subject.length > 0 ? Math.floor(+subject.length) : 0
+    length = +subject.length
   } else {
     throw new TypeError('must start with number, buffer, array or string')
   }
@@ -88,6 +88,11 @@ function Buffer (subject, encoding, noZero) {
     throw new RangeError('Attempt to allocate Buffer larger than maximum ' +
       'size: 0x' + kMaxLength.toString(16) + ' bytes')
 
+  if (length < 0)
+    length = 0
+  else
+    length >>>= 0 // Coerce to uint32.
+
   var self = this
   if (Buffer.TYPED_ARRAY_SUPPORT) {
     // Preferred: Return an augmented `Uint8Array` instance for best performance