{"action":"created","issue":{"url":"https://api.github.com/repos/nodejs/node/issues/2457","labels_url":"https://api.github.com/repos/nodejs/node/issues/2457/labels{/name}","comments_url":"https://api.github.com/repos/nodejs/node/issues/2457/comments","events_url":"https://api.github.com/repos/nodejs/node/issues/2457/events","html_url":"https://github.com/nodejs/node/issues/2457","id":102077921,"number":2457,"title":"Segfaults when writing to Buffer using UCS2 encoding","user":{"login":"vsimonian","id":9868643,"avatar_url":"https://avatars.githubusercontent.com/u/9868643?v=3","gravatar_id":"","url":"https://api.github.com/users/vsimonian","html_url":"https://github.com/vsimonian","followers_url":"https://api.github.com/users/vsimonian/followers","following_url":"https://api.github.com/users/vsimonian/following{/other_user}","gists_url":"https://api.github.com/users/vsimonian/gists{/gist_id}","starred_url":"https://api.github.com/users/vsimonian/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vsimonian/subscriptions","organizations_url":"https://api.github.com/users/vsimonian/orgs","repos_url":"https://api.github.com/users/vsimonian/repos","events_url":"https://api.github.com/users/vsimonian/events{/privacy}","received_events_url":"https://api.github.com/users/vsimonian/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/nodejs/node/labels/buffer","name":"buffer","color":"f7c6c7"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-08-20T07:17:28Z","updated_at":"2015-08-20T08:11:05Z","closed_at":null,"body":"The following code causes a segfault when `write` is called:\r\n\r\n```js\r\nvar text = '1234567890123456789012345678901234567890123456789';\r\nvar len = Buffer.byteLength(text, 'ucs2');\r\nvar buf = new Buffer(len);\r\nvar bytesWritten = buf.write(text, 0, 'ucs2');\r\n```\r\n\r\nThe odd thing about this bug is that it is intermittent, but consistent. Meaning, the code above always causes a segfault in my tests. However, when I change `text` to have an extra 0 at the end (`12345678901234567890123456789012345678901234567890`), it stops causing segfaults.\r\n\r\nEven more confusing is that if I take that same piece of text with a 0 at the end, the variant that _doesn't_ cause a segfault, and use it in the following code, it also always causes a segfault.\r\n\r\nThis code is also the code I've been using to test this bug. Basically, I've been calling this script with a bunch of sample text files, and the only encoding that ever causes a segfault is `ucs2`.\r\n\r\n**Test script:**\r\n\r\n```js\r\nvar text = '12345678901234567890123456789012345678901234567890';\r\n\r\nif (process.argv.length > 2) {\r\n  var lastArg = process.argv[process.argv.length - 1];\r\n  if (lastArg.indexOf('-') !== 0) {\r\n    var fs = require('fs');\r\n    text = fs.readFileSync(lastArg).toString();\r\n  }\r\n}\r\n\r\nconsole.log('Text to write:', text);\r\nconsole.log();\r\nconsole.log(text.length + ' characters');\r\n\r\nfunction write(encoding) {\r\n  console.log();\r\n  console.log('=== Writing using ' + encoding + ' encoding');\r\n  console.log();\r\n\r\n  try {\r\n\r\n    var len = Buffer.byteLength(text, encoding);\r\n\r\n    console.log('Required buffer length: ' + len);\r\n\r\n    var buf = new Buffer(len);\r\n    var bytesWritten = buf.write(text, 0, encoding);\r\n\r\n    console.log('Wrote ' + bytesWritten + ' bytes');\r\n    console.log(buf);\r\n\r\n  } catch (err) {\r\n    console.log('Error during write:', err);\r\n  }\r\n};\r\n\r\nwrite('base64');\r\nwrite('binary');\r\nwrite('utf8');\r\nwrite('hex');\r\nwrite('ascii');\r\nwrite('ucs2');\r\n```\r\n\r\n**Example output:**\r\n\r\n```text\r\nText to write: 12345678901234567890123456789012345678901234567890\r\n\r\n50 characters\r\n\r\n=== Writing using base64 encoding\r\n\r\nRequired buffer length: 37\r\nWrote 37 bytes\r\n<Buffer d7 6d f8 e7 ae fc f7 4d 76 df 8e 7a ef cf 74 d7 6d f8 e7 ae fc f7 4d 76 df 8e 7a ef cf 74 d7 6d f8 e7 ae fc f7>\r\n\r\n=== Writing using binary encoding\r\n\r\nRequired buffer length: 50\r\nWrote 50 bytes\r\n<Buffer 31 32 33 34 35 36 37 38 39 30 31 32 33 34 35 36 37 38 39 30 31 32 33 34 35 36 37 38 39 30 31 32 33 34 35 36 37 38 39 30 31 32 33 34 35 36 37 38 39 30>\r\n\r\n=== Writing using utf8 encoding\r\n\r\nRequired buffer length: 50\r\nWrote 50 bytes\r\n<Buffer 31 32 33 34 35 36 37 38 39 30 31 32 33 34 35 36 37 38 39 30 31 32 33 34 35 36 37 38 39 30 31 32 33 34 35 36 37 38 39 30 31 32 33 34 35 36 37 38 39 30>\r\n\r\n=== Writing using hex encoding\r\n\r\nRequired buffer length: 25\r\nWrote 25 bytes\r\n<Buffer 12 34 56 78 90 12 34 56 78 90 12 34 56 78 90 12 34 56 78 90 12 34 56 78 90>\r\n\r\n=== Writing using ascii encoding\r\n\r\nRequired buffer length: 50\r\nWrote 50 bytes\r\n<Buffer 31 32 33 34 35 36 37 38 39 30 31 32 33 34 35 36 37 38 39 30 31 32 33 34 35 36 37 38 39 30 31 32 33 34 35 36 37 38 39 30 31 32 33 34 35 36 37 38 39 30>\r\n\r\n=== Writing using ucs2 encoding\r\n\r\nRequired buffer length: 100\r\n[1]    3798 segmentation fault (core dumped)  node main.js\r\n```\r\n\r\n**Backtrace:**\r\n\r\n_[Full backtrace](https://gist.github.com/vsimonian/522d8ff3edb2fd3ebaf7)_\r\n\r\n```text\r\n#0  0x0000000000b6c595 in void v8::internal::String::WriteToFlat<unsigned short>(v8::internal::String*, unsigned short*, int, int) ()\r\n#1  0x000000000085124a in v8::String::Write(unsigned short*, int, int, int) const ()\r\n#2  0x0000000000d9980a in node::StringBytes::Write(v8::Isolate*, char*, unsigned long, v8::Local<v8::Value>, node::encoding, int*) ()\r\n#3  0x0000000000d74de8 in void node::Buffer::StringWrite<(node::encoding)3>(v8::FunctionCallbackInfo<v8::Value> const&) ()\r\n#4  0x00000000008653f7 in v8::internal::FunctionCallbackArguments::Call(void (*)(v8::FunctionCallbackInfo<v8::Value> const&)) ()\r\n```\r\n\r\nThis bug has acted very oddly, but yet I've managed to replicate it both on my current machine and on a fresh install of io.js on a separate computer. It affects versions 3.0.0 and 3.1.0, but I haven't tested any older versions."},"comment":{"url":"https://api.github.com/repos/nodejs/node/issues/comments/132927453","html_url":"https://github.com/nodejs/node/issues/2457#issuecomment-132927453","issue_url":"https://api.github.com/repos/nodejs/node/issues/2457","id":132927453,"user":{"login":"alexlamsl","id":1898413,"avatar_url":"https://avatars.githubusercontent.com/u/1898413?v=3","gravatar_id":"","url":"https://api.github.com/users/alexlamsl","html_url":"https://github.com/alexlamsl","followers_url":"https://api.github.com/users/alexlamsl/followers","following_url":"https://api.github.com/users/alexlamsl/following{/other_user}","gists_url":"https://api.github.com/users/alexlamsl/gists{/gist_id}","starred_url":"https://api.github.com/users/alexlamsl/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/alexlamsl/subscriptions","organizations_url":"https://api.github.com/users/alexlamsl/orgs","repos_url":"https://api.github.com/users/alexlamsl/repos","events_url":"https://api.github.com/users/alexlamsl/events{/privacy}","received_events_url":"https://api.github.com/users/alexlamsl/received_events","type":"User","site_admin":false},"created_at":"2015-08-20T08:11:05Z","updated_at":"2015-08-20T08:11:05Z","body":"Couldn't reproduce with `iojs 2.5.0` on Windows Server 2012 R2\r\n\r\nHowever, on an unrelated note, when I made a typo with `encoding`, `Buffer.byteLength()` does not err:\r\n```\r\nBuffer.byteLength(text, 'ucs2');\r\n// 98\r\nBuffer.byteLength(text, 'usc2');\r\n// 48\r\n```\r\n\r\nWhereas `buf.write()` would throw `TypeError: Unknown encoding: usc2`"}}