Repository navigation
OOB read in Buffer.prototype.indexOf #62873
Description
From @deepview-autofix:
Not a vuln because this is not in any release yet
To reproduce (you need a pre-release or main):
Welcome to Node.js v26.0.0-nightly20260421eb54e709c7.
Type ".help" for more information.
> Buffer.alloc(1).indexOf(1,0,-10)
4
> Buffer.alloc(1).indexOf(2,0,-10)
65
> Buffer.alloc(1).indexOf(255,0,-10)
292
> Buffer.alloc(65).indexOf(1,0,-1)
104
> Buffer.alloc(65).indexOf(1,0,-1)
664
> Buffer.alloc(65).indexOf(1,0,-1)
14656
> Buffer.alloc(2048).indexOf(145,0,-1)
189041
Code involved:
Lines 1187 to 1188 in b2248fd
Nothing validates limits on that, either in native side or in JS.
Regression since #62390
Activity
buffer: fix end parameter bugs in indexOf/lastIndexOf
buffer: fix end parameter bugs in indexOf/lastIndexOf
buffer: fix end parameter bugs in indexOf/lastIndexOf