From 45c1c4f00ccb1d4d3a6d9c81fed4ff17999e9daf Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Micha=C3=ABl=20Zasso?= <mic.besace@gmail.com>
Date: Tue, 1 Sep 2015 10:51:17 +0200
Subject: [PATCH] buffer: SlowBuffer only accept valid numeric values

Fixes a regression that appeared with the new Buffer implementation in v3.
Without this change, calling the SlowBuffer constructor with something else
than a number would abort on the C++ side. This makes sure that the length
argument is coerced to number or is 0.

Fixes: https://github.com/nodejs/node/issues/2634
PR-URL: https://github.com/nodejs/node/pull/2635
Reviewed-By: trevnorris - Trevor Norris <trev.norris@gmail.com>
Reviewed-By: cjihrig - Colin Ihrig <cjihrig@gmail.com>
---
 lib/buffer.js                     |  4 +--
 test/parallel/test-buffer-slow.js | 55 +++++++++++++++++++++++++++++++
 2 files changed, 57 insertions(+), 2 deletions(-)
 create mode 100644 test/parallel/test-buffer-slow.js

diff --git a/lib/buffer.js b/lib/buffer.js
index 13933001e830c7..39cd5f9e58b9f8 100644
--- a/lib/buffer.js
+++ b/lib/buffer.js
@@ -58,9 +58,9 @@ createPool();
 
 
 function SlowBuffer(length) {
-  if (length < 0)
+  if (+length != length)
     length = 0;
-  return binding.create(length);
+  return binding.create(+length);
 };
 
 SlowBuffer.prototype.__proto__ = Buffer.prototype;
diff --git a/test/parallel/test-buffer-slow.js b/test/parallel/test-buffer-slow.js
new file mode 100644
index 00000000000000..e652a6a0f95969
--- /dev/null
+++ b/test/parallel/test-buffer-slow.js
@@ -0,0 +1,55 @@
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+const buffer = require('buffer');
+const Buffer = buffer.Buffer;
+const SlowBuffer = buffer.SlowBuffer;
+
+const ones = [1, 1, 1, 1];
+
+// should create a Buffer
+let sb = new SlowBuffer(4);
+assert(sb instanceof Buffer);
+assert.strictEqual(sb.length, 4);
+sb.fill(1);
+assert.deepEqual(sb, ones);
+
+// underlying ArrayBuffer should have the same length
+assert.strictEqual(sb.buffer.byteLength, 4);
+
+// should work without new
+sb = SlowBuffer(4);
+assert(sb instanceof Buffer);
+assert.strictEqual(sb.length, 4);
+sb.fill(1);
+assert.deepEqual(sb, ones);
+
+// should work with edge cases
+assert.strictEqual(SlowBuffer(0).length, 0);
+try {
+  assert.strictEqual(SlowBuffer(buffer.kMaxLength).length, buffer.kMaxLength);
+} catch (e) {
+  assert.equal(e.message, 'Buffer allocation failed - process out of memory');
+}
+
+// should work with number-coercible values
+assert.strictEqual(SlowBuffer('6').length, 6);
+assert.strictEqual(SlowBuffer(true).length, 1);
+
+// should create zero-length buffer if parameter is not a number
+assert.strictEqual(SlowBuffer().length, 0);
+assert.strictEqual(SlowBuffer(NaN).length, 0);
+assert.strictEqual(SlowBuffer({}).length, 0);
+assert.strictEqual(SlowBuffer('string').length, 0);
+
+// should throw with invalid length
+assert.throws(function() {
+  new SlowBuffer(Infinity);
+}, 'invalid Buffer length');
+assert.throws(function() {
+  new SlowBuffer(-1);
+}, 'invalid Buffer length');
+assert.throws(function() {
+  new SlowBuffer(buffer.kMaxLength + 1);
+}, 'invalid Buffer length');