From 63eb4fee467c60cdbd60e07de3c6b707577f9c40 Mon Sep 17 00:00:00 2001
From: Brian White <mscdex@mscdex.net>
Date: Tue, 12 Nov 2019 22:41:12 -0500
Subject: [PATCH] buffer: fix 6-byte writeUIntBE() range check

Fixes: https://github.com/nodejs/node/issues/30420

PR-URL: https://github.com/nodejs/node/pull/30459
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: David Carlier <devnexen@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
Reviewed-By: James M Snell <jasnell@gmail.com>
---
 lib/internal/buffer.js                 | 2 +-
 test/parallel/test-buffer-writeint.js  | 2 +-
 test/parallel/test-buffer-writeuint.js | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/lib/internal/buffer.js b/lib/internal/buffer.js
index f3bc0e48d1c911..acd7d319d5e1b2 100644
--- a/lib/internal/buffer.js
+++ b/lib/internal/buffer.js
@@ -736,7 +736,7 @@ function writeUInt8(value, offset = 0) {
 
 function writeUIntBE(value, offset, byteLength) {
   if (byteLength === 6)
-    return writeU_Int48BE(this, value, offset, 0, 0xffffffffffffff);
+    return writeU_Int48BE(this, value, offset, 0, 0xffffffffffff);
   if (byteLength === 5)
     return writeU_Int40BE(this, value, offset, 0, 0xffffffffff);
   if (byteLength === 3)
diff --git a/test/parallel/test-buffer-writeint.js b/test/parallel/test-buffer-writeint.js
index 05b0cd1ebbfada..0e812cc8886941 100644
--- a/test/parallel/test-buffer-writeint.js
+++ b/test/parallel/test-buffer-writeint.js
@@ -213,7 +213,7 @@ const errorOutOfBounds = common.expectsError({
   });
 
   // Test 1 to 6 bytes.
-  for (let i = 1; i < 6; i++) {
+  for (let i = 1; i <= 6; i++) {
     ['writeIntBE', 'writeIntLE'].forEach((fn) => {
       const min = -(2 ** (i * 8 - 1));
       const max = 2 ** (i * 8 - 1) - 1;
diff --git a/test/parallel/test-buffer-writeuint.js b/test/parallel/test-buffer-writeuint.js
index 3823b74d565519..c7708d663eca80 100644
--- a/test/parallel/test-buffer-writeuint.js
+++ b/test/parallel/test-buffer-writeuint.js
@@ -170,7 +170,7 @@ const assert = require('assert');
   });
 
   // Test 1 to 6 bytes.
-  for (let i = 1; i < 6; i++) {
+  for (let i = 1; i <= 6; i++) {
     const range = i < 5 ? `= ${val - 1}` : ` 2 ** ${i * 8}`;
     const received = i > 4 ?
       String(val).replace(/(\d)(?=(\d\d\d)+(?!\d))/g, '$1_') :