buffer: ignore negative allocation lengths

addaleax · Myles Borins · commit 200429e9e195 · 2016-07-14T12:38:02.000-07:00
Treat negative length arguments to `Buffer()`/`allocUnsafe()` as if they were zero so the allocation does not affect the pool’s offset. Fixes: #7047 Refs: #7051 Refs: #7221 Refs: #7475 PR-URL: #7562 Reviewed-By: Trevor Norris <trev.norris@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Nikolai Vavilov <vvnicholas@gmail.com>
diff --git a/lib/buffer.js b/lib/buffer.js
@@ -79,8 +79,8 @@ Object.setPrototypeOf(SlowBuffer, Uint8Array);
 
 
 function allocate(size){
- if (size === 0){
- return createBuffer(size);
+ if (size <= 0){
+ return createBuffer(0);
 }
 if (size < (Buffer.poolSize >>> 1)){
 if (size > (poolSize - poolOffset))

Original file line number	Diff line number	Diff line change
`@@ -79,8 +79,8 @@ Object.setPrototypeOf(SlowBuffer, Uint8Array);`
`79`	`79`
`80`	`80`
`81`	`81`	`functionallocate(size){`
`82`		`-if(size===0){`
`83`		`-returncreateBuffer(size);`
	`82`	`+if(size<=0){`
	`83`	`+returncreateBuffer(0);`
`84`	`84`	`}`
`85`	`85`	`if(size<(Buffer.poolSize>>>1)){`
`86`	`86`	`if(size>(poolSize-poolOffset))`