limit 1

Author: chearon

src/ImageData.cc

@@ -30,7 +30,7 @@ ImageData::ImageData(const Napi::CallbackInfo& info) : Napi::ObjectWrap<ImageDat
   Napi::TypedArray dataArray;
   uint32_t width;
   uint32_t height;
-  int length;
+  size_t length;
 
   if (info[0].IsNumber() && info[1].IsNumber()) {
     width = info[0].As<Napi::Number>().Uint32Value();
@@ -43,6 +43,11 @@ ImageData::ImageData(const Napi::CallbackInfo& info) : Napi::ObjectWrap<ImageDat
       Napi::RangeError::New(env, "The source height is zero.").ThrowAsJavaScriptException();
       return;
     }
+    if (static_cast<uint64_t>(width) * height > INT32_MAX / 4) {
+      std::string msg = "buffer exceeds " + std::to_string(INT32_MAX) + " bytes";
+      Napi::Error::New(env, msg).ThrowAsJavaScriptException();
+      return;
+    }
     length = width * height * 4; // ImageData(w, h) constructor assumes 4 BPP; documented.
 
     dataArray = Napi::Uint8Array::New(env, length, napi_uint8_clamped_array);