buffer: don't abort on prototype getters

Accessing prototype properties directly on a typed array will throw. So
do an extra check in Buffer's own getters to verify it is being called
on an instance.

Fixes: https://github.com/nodejs/node/issues/3297
PR-URL: https://github.com/nodejs/node/pull/3302
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Jeremiah Senkpiel <fishrock123@rocketmail.com>

2 files changed, 11 insertions, 0 deletions

diff --git a/lib/buffer.js b/lib/buffer.js
index 98f6537931..41d5e0aba2 100644
--- a/lib/buffer.js
+++ b/lib/buffer.js
@@ -304,6 +304,8 @@ Buffer.byteLength = byteLength;
 Object.defineProperty(Buffer.prototype, 'parent', {
   enumerable: true,
   get: function() {
+    if (!(this instanceof Buffer))
+      return undefined;
     if (this.byteLength === 0 ||
         this.byteLength === this.buffer.byteLength) {
       return undefined;
@@ -314,6 +316,8 @@ Object.defineProperty(Buffer.prototype, 'parent', {
 Object.defineProperty(Buffer.prototype, 'offset', {
   enumerable: true,
   get: function() {
+    if (!(this instanceof Buffer))
+      return undefined;
     return this.byteOffset;
   }
 });
diff --git a/test/parallel/test-buffer.js b/test/parallel/test-buffer.js
index ab9cea3078..1be4f3b842 100644
--- a/test/parallel/test-buffer.js
+++ b/test/parallel/test-buffer.js
@@ -1224,3 +1224,10 @@ assert.throws(function() {
 assert.throws(function() {
   new Buffer(null);
 }, /must start with number, buffer, array or string/);
+
+
+// Test prototype getters don't throw
+assert.equal(Buffer.prototype.parent, undefined);
+assert.equal(Buffer.prototype.offset, undefined);
+assert.equal(SlowBuffer.prototype.parent, undefined);
+assert.equal(SlowBuffer.prototype.offset, undefined);