buffer: fix out of range for toString

Co-authored-by: Michaël Zasso <[email protected]> PR-URL: #54553 Backport-PR-URL: #55213Fixes: #52298 Reviewed-By: James M Snell <[email protected]> Reviewed-By: Jake Yuesong Li <[email protected]> Refs: #54553

Author: 2 people

lib/buffer.js

@@ -841,12 +841,12 @@ Buffer.prototype.toString = function toString(encoding, start, end){
 elseif(start>=len)
 return'';
 else
-start|=0;
+start=MathTrunc(start)||0;
 
 if(end===undefined||end>len)
 end=len;
 else
-end|=0;
+end=MathTrunc(end)||0;
 
 if(end<=start)
 return'';

test/parallel/test-buffer-tostring-range.js

@@ -1,6 +1,6 @@
 'use strict';
 
-require('../common');
+constcommon=require('../common');
 constassert=require('assert');
 
 constrangeBuffer=Buffer.from('abc');
@@ -98,3 +98,11 @@ assert.throws(() =>{
 name: 'TypeError',
 message: 'Unknown encoding: null'
 });
+
+// Must not throw when start and end are within kMaxLength
+// Cannot test on 32bit machine as we are testing the case
+// when start and end are above the threshold
+common.skipIf32Bits();
+constthreshold=0xFFFFFFFF;
+constlargeBuffer=Buffer.alloc(threshold);
+largeBuffer.toString('utf8',threshold+0xF,threshold+0xFF);