From 5c201b6d477525a080b11d1bd49a7c94fe81f8ac Mon Sep 17 00:00:00 2001
From: Brian White <mscdex@mscdex.net>
Date: Tue, 6 Nov 2018 18:16:16 -0500
Subject: [PATCH] buffer: fix writeUInt16BE range check

Fixes: https://github.com/nodejs/node/issues/24205

PR-URL: https://github.com/nodejs/node/pull/24208
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
---
 lib/internal/buffer.js                 |  2 +-
 test/parallel/test-buffer-writeuint.js | 12 ++++++++++++
 2 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/lib/internal/buffer.js b/lib/internal/buffer.js
index 61bdced4d63a58..137ca64142bf62 100644
--- a/lib/internal/buffer.js
+++ b/lib/internal/buffer.js
@@ -667,7 +667,7 @@ function writeU_Int16BE(buf, value, offset, min, max) {
 }
 
 function writeUInt16BE(value, offset = 0) {
-  return writeU_Int16BE(this, value, offset, 0, 0xffffffff);
+  return writeU_Int16BE(this, value, offset, 0, 0xffff);
 }
 
 function writeIntLE(value, offset, byteLength) {
diff --git a/test/parallel/test-buffer-writeuint.js b/test/parallel/test-buffer-writeuint.js
index 999440114c74f4..387aafd3354a35 100644
--- a/test/parallel/test-buffer-writeuint.js
+++ b/test/parallel/test-buffer-writeuint.js
@@ -84,6 +84,18 @@ const assert = require('assert');
 
   data.writeUInt16BE(value, 0);
   assert.ok(data.equals(new Uint8Array([0xff, 0x80, 0x43, 0x23])));
+
+  value = 0xfffff;
+  ['writeUInt16BE', 'writeUInt16LE'].forEach((fn) => {
+    assert.throws(
+      () => data[fn](value, 0),
+      {
+        code: 'ERR_OUT_OF_RANGE',
+        message: 'The value of "value" is out of range. ' +
+                 `It must be >= 0 and <= 65535. Received ${value}`
+      }
+    );
+  });
 }
 
 // Test 32 bit