buffer: fix out of range for toString

jazelly · targos · marco-ippolito · commit 6b3c24dbad48 · 2024-11-16T11:48:53.000+01:00
Co-authored-by: Michaël Zasso <targos@protonmail.com> PR-URL: #54553 Backport-PR-URL: #55213 Fixes: #52298 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Jake Yuesong Li <jake.yuesong@gmail.com> Refs: #54553
diff --git a/lib/buffer.js b/lib/buffer.js
@@ -841,12 +841,12 @@ Buffer.prototype.toString = function toString(encoding, start, end) {
   else if (start >= len)
     return '';
   else
-    start |= 0;
+    start = MathTrunc(start) || 0;
 
   if (end === undefined || end > len)
     end = len;
   else
-    end |= 0;
+    end = MathTrunc(end) || 0;
 
   if (end <= start)
     return '';
diff --git a/test/parallel/test-buffer-tostring-range.js b/test/parallel/test-buffer-tostring-range.js
@@ -1,6 +1,6 @@
 'use strict';
 
-require('../common');
+const common = require('../common');
 const assert = require('assert');
 
 const rangeBuffer = Buffer.from('abc');
@@ -98,3 +98,11 @@ assert.throws(() => {
   name: 'TypeError',
   message: 'Unknown encoding: null'
 });
+
+// Must not throw when start and end are within kMaxLength
+// Cannot test on 32bit machine as we are testing the case
+// when start and end are above the threshold
+common.skipIf32Bits();
+const threshold = 0xFFFFFFFF;
+const largeBuffer = Buffer.alloc(threshold);
+largeBuffer.toString('utf8', threshold + 0xF, threshold + 0xFF);
