Skip to content

buffer: fix copy() segfault with zero arguments

Buffer#copy() immediately does a ToObject() on the first argument before it checks if it's even an Object. This causes Object::HasIndexedPropertiesInExternalArrayData() to be run on nothing, triggering the segfault. Instead run HasInstance() on the args Value. Which will check if it's actually an Object, before checking if it contains data.

Fixes: https://github.com/iojs/io.js/issues/1519

Merge request reports

Loading