buffer: throw from constructor if length > kMaxLength

Throw, don't abort. `new Buffer(0x3fffffff + 1)` used to bring down the process
with the following error message:

  FATAL ERROR: v8::Object::SetIndexedPropertiesToExternalArrayData() length
  exceeds max acceptable value

Fixes #2280.

3 files changed, 17 insertions, 7 deletions

diff --git a/src/node_buffer.cc b/src/node_buffer.cc
index 14aa3ef612..12fe1e0962 100644
--- a/src/node_buffer.cc
+++ b/src/node_buffer.cc
@@ -171,13 +171,14 @@ Handle<Value> Buffer::New(const Arguments &args) {
 
   HandleScope scope;
 
-  if (args[0]->IsInt32()) {
-    // var buffer = new Buffer(1024);
-    size_t length = args[0]->Uint32Value();
-    new Buffer(args.This(), length);
-  } else {
-    return ThrowException(Exception::TypeError(String::New("Bad argument")));
+  if (!args[0]->IsUint32()) return ThrowTypeError("Bad argument");
+
+  size_t length = args[0]->Uint32Value();
+  if (length > Buffer::kMaxLength) {
+    return ThrowRangeError("length > kMaxLength");
   }
+  new Buffer(args.This(), length);
+
   return args.This();
 }
 
diff --git a/src/node_buffer.h b/src/node_buffer.h
index ef7cf4fd83..abfafa3264 100644
--- a/src/node_buffer.h
+++ b/src/node_buffer.h
@@ -65,6 +65,9 @@ namespace node {
 
 class NODE_EXTERN Buffer: public ObjectWrap {
  public:
+  // mirrors deps/v8/src/objects.h
+  static const int kMaxLength = 0x3fffffff;
+
   static v8::Persistent<v8::FunctionTemplate> constructor_template;
 
   static bool HasInstance(v8::Handle<v8::Value> val);
diff --git a/src/v8_typed_array.cc b/src/v8_typed_array.cc
index 76a636135b..8cf16a3d73 100644
--- a/src/v8_typed_array.cc
+++ b/src/v8_typed_array.cc
@@ -91,6 +91,10 @@ class ArrayBuffer {
     }
 
     size_t num_bytes = args[0]->Uint32Value();
+    if (num_bytes > node::Buffer::kMaxLength) {
+      return ThrowRangeError("length > kMaxLength");
+    }
+
     void* buf = calloc(num_bytes, 1);
     if (!buf)
       return ThrowError("Unable to allocate ArrayBuffer.");
@@ -224,6 +228,7 @@ class TypedArray {
           v8::Integer::NewFromUnsigned(length * TBytes)};
       buffer = ArrayBuffer::GetTemplate()->
                  GetFunction()->NewInstance(1, argv);
+      if (buffer.IsEmpty()) return v8::Undefined(); // constructor failed
 
       void* buf = buffer->GetPointerFromInternalField(0);
       args.This()->SetIndexedPropertiesToExternalArrayData(
@@ -252,8 +257,9 @@ class TypedArray {
 
       buffer = ArrayBuffer::GetTemplate()->
                  GetFunction()->NewInstance(1, argv);
-      void* buf = buffer->GetPointerFromInternalField(0);
+      if (buffer.IsEmpty()) return v8::Undefined(); // constructor failed
 
+      void* buf = buffer->GetPointerFromInternalField(0);
       args.This()->SetIndexedPropertiesToExternalArrayData(
           buf, TEAType, length);
       // TODO(deanm): check for failure.