[Fix] validate that arrays contain valid byte values

Author: ljharb

index.js

@@ -51,14 +51,28 @@ module.exports = function toBuffer(data, encoding) {
 		return Buffer.from(data);
 	}
 
+	var isArr = isArray(data);
+	if (isArr) {
+		for (var i = 0; i < data.length; i += 1) {
+			var x = data[i];
+			if (
+				typeof x !== 'number'
+				|| x < 0
+				|| x > 255
+				|| ~~x !== x // NaN and integer check
+			) {
+				throw new RangeError('Array items must be numbers in the range 0-255.');
+			}
+		}
+	}
+
 	/*
 	 * Old Buffer polyfill on an engine that doesn't have TypedArray support
 	 * Also, this is from a different Buffer polyfill implementation then we have, as instanceof check failed
 	 * Convert to our current Buffer implementation
 	 */
 	if (
-		isArray(data)
-		|| (
+		isArr || (
 			Buffer.isBuffer(data)
 				&& data.constructor
 				&& typeof data.constructor.isBuffer === 'function'

test/index.js

@@ -24,6 +24,15 @@ test('string + enc returns buffer', function (t) {
 
 test('array returns buffer', function (t) {
 	t.deepEqual(toBuffer([104, 105]), new Buffer('hi'));
+
+	forEach([-1, 256, NaN, 4.2, Infinity], function (nonByte) {
+		t['throws'](
+			function () { toBuffer([0, 42, nonByte]); },
+			RangeError,
+			nonByte + ': arrays with out-of-bounds byte values throw'
+		);
+	});
+
 	t.end();
 });