René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"buffer: indexOf/includes clamp byteOffset to 2^31-1 and return a negative index on buffers over 2 GiB","articleBody":"### Version\n\nv24.22.1 (also v22.23.3)\n\n### Platform\n\n```text\nLinux 5.15.167.4-microsoft-standard-WSL2 x86_64 GNU/Linux\n```\n\n### Subsystem\n\nbuffer\n\n### What steps will reproduce the bug?\n\n```js\n// Buffer.indexOf / includes with a byteOffset above 2^31 - 1\nconst G = 2 ** 30;\nconst buf = Buffer.alloc(3 * G);\nbuf[2.25 * G] = 0x0a; // a newline BEFORE byteOffset\nbuf[2.75 * G] = 0x0a; // the first newline AFTER byteOffset\n\nconst from = 2.5 * G;\nconst got = buf.indexOf(0x0a, from);\nconsole.log(`indexOf(0x0a, ${from})   = ${got}  (expected ${2.75 * G})`);\nconsole.log(`  returned index \u003c byteOffset: ${got !== -1 && got \u003c from}`);\nconsole.log(`includes(0x0a, ${2.9 * G}) = ${buf.includes(0x0a, 2.9 * G)}  (expected false)`);\nconsole.log(`subarray(from).indexOf + from = ${from + buf.subarray(from).indexOf(0x0a)}  (correct)`);\n```\n\n### How often does it reproduce? Is there a required condition?\n\nAlways, when the buffer is larger than 2 GiB and `byteOffset` is above `2^31 - 1`.\n\n### What is the expected behavior? Why is that the expected behavior?\n\n```\nindexOf(0x0a, 2684354560)   = 2952790016  (expected 2952790016)\n  returned index \u003c byteOffset: false\nincludes(0x0a, 3113851289.6) = false  (expected false)\n```\n\n`indexOf` should return the first match at or after `byteOffset`, and buffers this size are within `buffer.constants.MAX_LENGTH`.\n\n### What do you see instead?\n\n```\nindexOf(0x0a, 2684354560)   = -1879048192  (expected 2952790016)\n  returned index \u003c byteOffset: true\nincludes(0x0a, 3113851289.6) = true  (expected false)\nsubarray(from).indexOf + from = 2952790016  (correct)\n```\n\n### Additional information\n\nTwo problems combine here:\n\n1. `byteOffset` appears to be clamped to `2^31 - 1`, so the search starts at 2 GiB. It finds the newline at 2.25 GiB, which is before the requested offset, and `includes` returns `true` for a range that has no match.\n2. The returned index is then wrapped to int32: `-1879048192` is `2415919104 - 2^32`, the position of the 2.25 GiB newline. A negative non-`-1` result isn't a valid return value.\n\nSearching a `subarray` gives the right answer, so only the offset argument and the return value are affected.\n\nBun 1.4.4 has the same offset clamp (without the negative return). Reported there separately.\n","author":{"url":"https://github.com/ozonedev27","@type":"Person","name":"ozonedev27"},"datePublished":"2026-10-26T00:16:06Z","url":"https://github.com/nodejs/node/issues/67008"}