fix: out of bounds copy

Fixes: nodejs#54573
nxtedition · Oct 4, 2024 · f66394a · f66394a
1 parent d2ad9b4
commit f66394a
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 1 deletion.
diff --git a/lib/v8.js b/lib/v8.js
@@ -368,7 +368,7 @@ class DefaultDeserializer extends Deserializer {
     }
     // Copy to an aligned buffer first.
     const buffer_copy = Buffer.allocUnsafe(byteLength);
-    copy(this.buffer, buffer_copy, 0, byteOffset, byteOffset + byteLength);
+    copy(this.buffer, buffer_copy, 0, byteOffset, byteLength);
     return new ctor(buffer_copy.buffer,
                     buffer_copy.byteOffset,
                     byteLength / BYTES_PER_ELEMENT);

diff --git a/test/parallel/test-v8-deserialize-buffer.js b/test/parallel/test-v8-deserialize-buffer.js
@@ -5,3 +5,7 @@ const v8 = require('v8');
 
 process.on('warning', common.mustNotCall());
 v8.deserialize(v8.serialize(Buffer.alloc(0)));
+v8.deserialize(v8.serialize({a: new Int32Array(1024)}))
+v8.deserialize(v8.serialize({b: new Int16Array(8192)}))
+v8.deserialize(v8.serialize({c: new Uint32Array(1024)}))
+v8.deserialize(v8.serialize({d: new Uint16Array(8192)}))