nodejs
diff --git a/‎lib/internal/buffer.js‎
Lines changed: 12 additions & 3 deletions b/‎lib/internal/buffer.js‎
Lines changed: 12 additions & 3 deletions
diff --git a/‎src/node_buffer.cc‎
Lines changed: 5 additions & 0 deletions b/‎src/node_buffer.cc‎
Lines changed: 5 additions & 0 deletions
diff --git a/‎test/parallel/test-buffer-write.js‎
Lines changed: 14 additions & 0 deletions b/‎test/parallel/test-buffer-write.js‎
Lines changed: 14 additions & 0 deletions
@@ -960,30 +960,39 @@ function writeFloatBackwards(val, offset = 0) {
 
 class FastBuffer extends Uint8Array {}
 
-function asciiWrite(buf, string, offset = 0, length = buf.byteLength - offset) {
+function asciiWrite(buf, string, offset = 0, length) {
+  offset = Number(offset);
   if (offset < 0 || offset > buf.byteLength) {
     throw new ERR_BUFFER_OUT_OF_BOUNDS('offset');
   }
+  if (length === undefined) length = buf.byteLength - offset;
+  else length = Number(length);
   if (length < 0 || length > buf.byteLength - offset) {
     throw new ERR_BUFFER_OUT_OF_BOUNDS('length');
   }
   return asciiWriteStatic(buf, string, offset, length);
 }
 
-function latin1Write(buf, string, offset = 0, length = buf.byteLength - offset) {
+function latin1Write(buf, string, offset = 0, length) {
+  offset = Number(offset);
   if (offset < 0 || offset > buf.byteLength) {
     throw new ERR_BUFFER_OUT_OF_BOUNDS('offset');
   }
+  if (length === undefined) length = buf.byteLength - offset;
+  else length = Number(length);
   if (length < 0 || length > buf.byteLength - offset) {
     throw new ERR_BUFFER_OUT_OF_BOUNDS('length');
   }
   return latin1WriteStatic(buf, string, offset, length);
 }
 
-function utf8Write(buf, string, offset = 0, length = buf.byteLength - offset) {
+function utf8Write(buf, string, offset = 0, length) {
+  offset = Number(offset);
   if (offset < 0 || offset > buf.byteLength) {
     throw new ERR_BUFFER_OUT_OF_BOUNDS('offset');
   }
+  if (length === undefined) length = buf.byteLength - offset;
+  else length = Number(length);
   if (length < 0 || length > buf.byteLength - offset) {
     throw new ERR_BUFFER_OUT_OF_BOUNDS('length');
   }
 
@@ -1734,6 +1734,11 @@ void SlowWriteString(const FunctionCallbackInfo<Value>& args) {
   size_t max_length = 0;
 
   THROW_AND_RETURN_IF_OOB(ParseArrayIndex(env, args[2], 0, &offset));
+  if (offset > ts_obj_length) {
+    return node::THROW_ERR_BUFFER_OUT_OF_BOUNDS(
+        env, "\"offset\" is outside of buffer bounds");
+  }
+
   THROW_AND_RETURN_IF_OOB(
       ParseArrayIndex(env, args[3], ts_obj_length - offset, &max_length));
 
 
@@ -127,3 +127,17 @@ assert.throws(() => {
 }, common.expectsError({
   code: 'ERR_BUFFER_OUT_OF_BOUNDS',
 }));
+
+for (const method of ['asciiWrite', 'latin1Write', 'utf8Write']) {
+  let calls = 0;
+  const offset = {
+    valueOf() {
+      calls++;
+      return 2;
+    },
+  };
+  assert.throws(() => Buffer.alloc(1)[method]('ww', offset, 1), common.expectsError({
+    code: 'ERR_BUFFER_OUT_OF_BOUNDS',
+  }));
+  assert.strictEqual(calls, 1);
+}
Original file line number	Diff line number	Diff line change
`@@ -960,30 +960,39 @@ function writeFloatBackwards(val, offset = 0) {`
`960`	`960`
`961`	`961`	`class FastBuffer extends Uint8Array {}`
`962`	`962`
`963`		`-function asciiWrite(buf, string, offset = 0, length = buf.byteLength - offset) {`
	`963`	`+function asciiWrite(buf, string, offset = 0, length) {`
	`964`	`+ offset = Number(offset);`
`964`	`965`	`if (offset < 0 \|\| offset > buf.byteLength) {`
`965`	`966`	`throw new ERR_BUFFER_OUT_OF_BOUNDS('offset');`
`966`	`967`	`}`
	`968`	`+ if (length === undefined) length = buf.byteLength - offset;`
	`969`	`+ else length = Number(length);`
`967`	`970`	`if (length < 0 \|\| length > buf.byteLength - offset) {`
`968`	`971`	`throw new ERR_BUFFER_OUT_OF_BOUNDS('length');`
`969`	`972`	`}`
`970`	`973`	`return asciiWriteStatic(buf, string, offset, length);`
`971`	`974`	`}`
`972`	`975`
`973`		`-function latin1Write(buf, string, offset = 0, length = buf.byteLength - offset) {`
	`976`	`+function latin1Write(buf, string, offset = 0, length) {`
	`977`	`+ offset = Number(offset);`
`974`	`978`	`if (offset < 0 \|\| offset > buf.byteLength) {`
`975`	`979`	`throw new ERR_BUFFER_OUT_OF_BOUNDS('offset');`
`976`	`980`	`}`
	`981`	`+ if (length === undefined) length = buf.byteLength - offset;`
	`982`	`+ else length = Number(length);`
`977`	`983`	`if (length < 0 \|\| length > buf.byteLength - offset) {`
`978`	`984`	`throw new ERR_BUFFER_OUT_OF_BOUNDS('length');`
`979`	`985`	`}`
`980`	`986`	`return latin1WriteStatic(buf, string, offset, length);`
`981`	`987`	`}`
`982`	`988`
`983`		`-function utf8Write(buf, string, offset = 0, length = buf.byteLength - offset) {`
	`989`	`+function utf8Write(buf, string, offset = 0, length) {`
	`990`	`+ offset = Number(offset);`
`984`	`991`	`if (offset < 0 \|\| offset > buf.byteLength) {`
`985`	`992`	`throw new ERR_BUFFER_OUT_OF_BOUNDS('offset');`
`986`	`993`	`}`
	`994`	`+ if (length === undefined) length = buf.byteLength - offset;`
	`995`	`+ else length = Number(length);`
`987`	`996`	`if (length < 0 \|\| length > buf.byteLength - offset) {`
`988`	`997`	`throw new ERR_BUFFER_OUT_OF_BOUNDS('length');`
`989`	`998`	`}`