Fix unintialized memory access

Author: mcollina

BufferList.js

@@ -134,19 +134,23 @@ BufferList.prototype.copy = function copy (dst, dstStart, srcStart, srcEnd) {
 
  if (bytes > l) {
  this._bufs[i].copy(dst, bufoff, start)
+ bufoff += l
  } else {
  this._bufs[i].copy(dst, bufoff, start, start + bytes)
+ bufoff += l
  break
  }
 
- bufoff += l
  bytes -= l
 
  if (start) {
  start = 0
  }
  }
 
+ // safeguard so that we don't return uninitialized memory
+ if (dst.length > bufoff) return dst.slice(0, bufoff)
+
  return dst
 }
 
@@ -188,6 +192,11 @@ BufferList.prototype.toString = function toString (encoding, start, end) {
 }
 
 BufferList.prototype.consume = function consume (bytes) {
+ // first, normalize the argument, in accordance with how Buffer does it
+ bytes = Math.trunc(bytes)
+ // do nothing if not a positive number
+ if (Number.isNaN(bytes) || bytes <= 0) return this
+
  while (this._bufs.length) {
  if (bytes >= this._bufs[0].length) {
  bytes -= this._bufs[0].length

test/test.js

@@ -463,6 +463,22 @@ tape('test toString encoding', function (t) {
  t.end()
 })
 
+tape('uninitialized memory', function (t) {
+ const secret = crypto.randomBytes(256)
+ for (let i = 0; i < 1e6; i++) {
+ const clone = Buffer.from(secret)
+ const bl = new BufferList()
+ bl.append(Buffer.from('a'))
+ bl.consume(-1024)
+ const buf = bl.slice(1)
+ if (buf.indexOf(clone) !== -1) {
+ t.fail(`Match (at ${i})`)
+ break
+ }
+ }
+ t.end()
+})
+
 !process.browser && tape('test stream', function (t) {
  const random = crypto.randomBytes(65534)