`Buffer.concat` and `Buffer.copy` silently produce invalid results when the operation involves indices equal or greater than 2^32
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 122k
- Forks
- 37.3k
- Avg merge
- 4d 2h
- Merged PRs (30d)
- 283
Description
Version
v22.9.0, v23.0.0
Platform
Windows 11 x64
Microsoft Windows NT 10.0.22631.0 x64
Subsystem
Buffer
What steps will reproduce the bug?
const largeBuffer = Buffer.alloc(2 ** 32 + 5)
largeBuffer.fill(111)
const result = Buffer.concat([largeBuffer])
console.log(result)
How often does it reproduce? Is there a required condition?
Consistent in v22.9.0 and v23.0.0
What is the expected behavior? Why is that the expected behavior?
All bytes of the return buffer produced by Buffer.concat([largeBuffer]) should be identical to the source:
In this example:
111, 111, 111, 111, 111, 111, 111, 111, 111, 111, 111, ....
What do you see instead?
In the returned buffer, first 5 bytes are 111, and all following ones are 0.
111, 111, 111, 111, 111, 0, 0, 0, 0, 0, 0, ....
The console.log(result) output looks like:
<Buffer 6f 6f 6f 6f 6f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ... 4294967251
more bytes>
Additional information
No response
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by running the reported Node.js v22.9.0 or v23.0.0 reproduction on Windows x64, then inspect the Buffer.concat and Buffer.copy implementation and their existing tests. Trace handling of indices at or above 2^32. Done means large-buffer operations preserve all source bytes and regression coverage verifies the boundary behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- backend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100