From 1ed3193bb3a49382ac2843e9be6a07edca070a1c Mon Sep 17 00:00:00 2001
From: Ruben Bridgewater <ruben@bridgewater.de>
Date: Tue, 2 Apr 2019 04:40:25 +0200
Subject: [PATCH] buffer: remove support for unknown objects

So far objects with a `length` property that was not an integer or
positive resulted in an empty buffer being created. That is not ideal
as it's not really clear what the intention in was.
This throws an error from now on instead.
---
 lib/buffer.js                            |  7 +++----
 test/parallel/test-buffer-alloc.js       | 18 ++++++++++++------
 test/parallel/test-buffer-arraybuffer.js |  5 ++++-
 3 files changed, 19 insertions(+), 11 deletions(-)

diff --git a/lib/buffer.js b/lib/buffer.js
index dd4e2952c8b23f..f34568fe546935 100644
--- a/lib/buffer.js
+++ b/lib/buffer.js
@@ -28,6 +28,7 @@ const {
   MathFloor,
   MathMin,
   MathTrunc,
+  NumberIsInteger,
   NumberIsNaN,
   NumberMAX_SAFE_INTEGER,
   NumberMIN_SAFE_INTEGER,
@@ -488,10 +489,8 @@ function fromObject(obj) {
     return b;
   }
 
-  if (obj.length !== undefined || isAnyArrayBuffer(obj.buffer)) {
-    if (typeof obj.length !== 'number') {
-      return new FastBuffer();
-    }
+  if ((NumberIsInteger(obj.length) && obj.length >= 0) ||
+      isAnyArrayBuffer(obj.buffer)) {
     return fromArrayLike(obj);
   }
 
diff --git a/test/parallel/test-buffer-alloc.js b/test/parallel/test-buffer-alloc.js
index b54fd88cc2506c..1812e4bf2dbcc7 100644
--- a/test/parallel/test-buffer-alloc.js
+++ b/test/parallel/test-buffer-alloc.js
@@ -769,8 +769,14 @@ Buffer.allocUnsafe(3.3).fill().toString();
 // Throws bad argument error in commit 43cb4ec
 Buffer.alloc(3.3).fill().toString();
 assert.strictEqual(Buffer.allocUnsafe(3.3).length, 3);
-assert.strictEqual(Buffer.from({ length: 3.3 }).length, 3);
-assert.strictEqual(Buffer.from({ length: 'BAM' }).length, 0);
+assert.throws(
+  () => Buffer.from({ length: 3.3 }),
+  { code: 'ERR_INVALID_ARG_TYPE' }
+);
+assert.throws(
+  () => Buffer.from({ length: 'BAM' }),
+  { code: 'ERR_INVALID_ARG_TYPE' }
+);
 
 // Make sure that strings are not coerced to numbers.
 assert.strictEqual(Buffer.from('99').length, 2);
@@ -993,10 +999,10 @@ assert.strictEqual(SlowBuffer.prototype.offset, undefined);
   // Test that large negative Buffer length inputs don't affect the pool offset.
   // Use the fromArrayLike() variant here because it's more lenient
   // about its input and passes the length directly to allocate().
-  assert.deepStrictEqual(Buffer.from({ length: -Buffer.poolSize }),
-                         Buffer.from(''));
-  assert.deepStrictEqual(Buffer.from({ length: -100 }),
-                         Buffer.from(''));
+  assert.throws(
+    () => Buffer.from({ length: -Buffer.poolSize }),
+    { code: 'ERR_INVALID_ARG_TYPE' }
+  );
 
   // Check pool offset after that by trying to write string into the pool.
   Buffer.from('abc');
diff --git a/test/parallel/test-buffer-arraybuffer.js b/test/parallel/test-buffer-arraybuffer.js
index c69d3ed632c6e6..0165e1db526a39 100644
--- a/test/parallel/test-buffer-arraybuffer.js
+++ b/test/parallel/test-buffer-arraybuffer.js
@@ -150,4 +150,7 @@ assert.throws(function() {
 }
 
 // Test an array like entry with the length set to NaN.
-assert.deepStrictEqual(Buffer.from({ length: NaN }), Buffer.alloc(0));
+assert.throws(
+  () => Buffer.from({ length: NaN }),
+  { code: 'ERR_INVALID_ARG_TYPE' }
+);