From 40c334de2c4e855fda9f75ec5444c7b4ced2c77b Mon Sep 17 00:00:00 2001
From: Trevor Norris <trev.norris@gmail.com>
Date: Thu, 18 Jun 2015 14:07:22 -0600
Subject: [PATCH] buffer: prevent abort on bad proto

If an object's prototype is munged it's possible to bypass the
instanceof check and cause the application to abort. Instead now use
HasInstance() to verify that the object is a Buffer, and throw if not.

This check will not work for JS only methods. So while the application
won't abort, it also won't throw.

In order to properly throw in all cases with toString() the JS
optimization of checking that length is zero has been removed. In its
place the native methods will now return early if a zero length string
is detected.

Ref: https://github.com/nodejs/io.js/pull/1486
Ref: https://github.com/nodejs/io.js/pull/1922
Fixes: https://github.com/nodejs/io.js/issues/1485
PR-URL: https://github.com/nodejs/io.js/pull/2012
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
---
 test/parallel/test-buffer-fakes.js | 56 ++++++++++++++++++++++++++++++
 1 file changed, 56 insertions(+)
 create mode 100644 test/parallel/test-buffer-fakes.js

diff --git a/test/parallel/test-buffer-fakes.js b/test/parallel/test-buffer-fakes.js
new file mode 100644
index 00000000000000..d473d16e92159f
--- /dev/null
+++ b/test/parallel/test-buffer-fakes.js
@@ -0,0 +1,56 @@
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+const Buffer = require('buffer').Buffer;
+const Bp = Buffer.prototype;
+
+function FakeBuffer() { }
+FakeBuffer.__proto__ = Buffer;
+FakeBuffer.prototype.__proto__ = Buffer.prototype;
+
+const fb = new FakeBuffer();
+
+assert.throws(function() {
+  new Buffer(fb);
+}, TypeError);
+
+assert.throws(function() {
+  +Buffer.prototype;
+}, TypeError);
+
+assert.throws(function() {
+  Buffer.compare(fb, new Buffer(0));
+}, TypeError);
+
+assert.throws(function() {
+  fb.write('foo');
+}, TypeError);
+
+assert.throws(function() {
+  Buffer.concat([fb, fb]);
+}, TypeError);
+
+assert.throws(function() {
+  fb.toString();
+}, TypeError);
+
+assert.throws(function() {
+  fb.equals(new Buffer(0));
+}, TypeError);
+
+assert.throws(function() {
+  fb.indexOf(5);
+}, TypeError);
+
+assert.throws(function() {
+  fb.readFloatLE(0);
+}, TypeError);
+
+assert.throws(function() {
+  fb.writeFloatLE(0);
+}, TypeError);
+
+assert.throws(function() {
+  fb.fill(0);
+}, TypeError);