diff --git a/src/node_buffer.cc b/src/node_buffer.cc index 9adb02517efc42..81c3894a3914e2 100644 --- a/src/node_buffer.cc +++ b/src/node_buffer.cc @@ -1569,6 +1569,10 @@ void CopyArrayBuffer(const FunctionCallbackInfo& args) { uint32_t source_offset = args[3].As()->Value(); size_t bytes_to_copy = args[4].As()->Value(); + // Assert the offsets are within bounds before the subtractions below, which + // would otherwise underflow and defeat the bytes_to_copy bounds checks. + CHECK_LE(destination_offset, destination_byte_length); + CHECK_LE(source_offset, source_byte_length); CHECK_GE(destination_byte_length - destination_offset, bytes_to_copy); CHECK_GE(source_byte_length - source_offset, bytes_to_copy);