buffer: ignore negative allocation lengths

Treat negative length arguments to `Buffer()`/`allocUnsafe()` as if they were zero so the allocation does not affect the pool’s offset. Fixes: #7047 PR-URL: #7051 Reviewed-By: Sakthipriyan Vairamani <[email protected]> Reviewed-By: Ben Noordhuis <[email protected]> Reviewed-By: Сковорода Никита Андреевич <[email protected]> Reviewed-By: Trevor Norris <[email protected]> Reviewed-By: Rod Vagg <[email protected]>

Author: addaleax

lib/buffer.js

@@ -199,8 +199,8 @@ Object.setPrototypeOf(SlowBuffer, Uint8Array);
 
 
 functionallocate(size){
-if(size===0){
-returncreateBuffer(size);
+if(size<=0){
+returncreateBuffer(0);
 }
 if(size<(Buffer.poolSize>>>1)){
 if(size>(poolSize-poolOffset))

test/parallel/test-buffer.js

@@ -1465,3 +1465,14 @@ assert.equal(Buffer.prototype.parent, undefined);
 assert.equal(Buffer.prototype.offset,undefined);
 assert.equal(SlowBuffer.prototype.parent,undefined);
 assert.equal(SlowBuffer.prototype.offset,undefined);
+
+{
+// Test that large negative Buffer length inputs don't affect the pool offset.
+assert.deepStrictEqual(Buffer(-Buffer.poolSize),Buffer.from(''));
+assert.deepStrictEqual(Buffer(-100),Buffer.from(''));
+assert.deepStrictEqual(Buffer.allocUnsafe(-Buffer.poolSize),Buffer.from(''));
+assert.deepStrictEqual(Buffer.allocUnsafe(-100),Buffer.from(''));
+
+// Check pool offset after that by trying to write string into the pool.
+assert.doesNotThrow(()=>Buffer.from('abc'));
+}