buffer: fix sign overflow in readUIn32BE

`|` operation takes precendence on `+`, which will result in `new Buffer('ffffffff', 16).readUInt32BE(0)` returning `-1` instead of `ffffffff`.
nodejs · Jul 29, 2014 · 38f6fcd · 38f6fcd
1 parent 338ba2b
commit 38f6fcd
Show file tree

Hide file tree

Showing 2 changed files with 18 additions and 2 deletions.
diff --git a/lib/buffer.js b/lib/buffer.js
@@ -621,8 +621,8 @@ Buffer.prototype.readUInt32BE = function(offset, noAssert) {
 
   return (this[offset] * 0x1000000) +
       ((this[offset + 1] << 16) |
-      (this[offset + 2] << 8)) |
-      (this[offset + 3]);
+      (this[offset + 2] << 8) |
+      this[offset + 3]);
 };
 
 

diff --git a/test/simple/test-buffer.js b/test/simple/test-buffer.js
@@ -964,6 +964,22 @@ assert.throws(function() { buf.readInt8(0); }, /beyond buffer length/);
   );
 });
 
+[16, 32].forEach(function(bits) {
+  var buf = new Buffer([0xFF, 0xFF, 0xFF, 0xFF]);
+
+  assert.equal(buf['readUInt' + bits + 'BE'](0),
+                (0xFFFFFFFF >>> (32 - bits)));
+
+  assert.equal(buf['readUInt' + bits + 'LE'](0),
+                (0xFFFFFFFF >>> (32 - bits)));
+
+  assert.equal(buf['readInt' + bits + 'BE'](0),
+                (0xFFFFFFFF >> (32 - bits)));
+
+  assert.equal(buf['readInt' + bits + 'LE'](0),
+                (0xFFFFFFFF >> (32 - bits)));
+});
+
 // SlowBuffer sanity checks.
 assert.throws(function() {
   var len = 0xfffff;