tls: throw on invalid ALPNProtocols instead of aborting

tls.connect() with malformed ALPNProtocols hit
CHECK_EQ(0, SSL_set_alpn_protos(...)) in the C++ layer and aborted
the process with SIGABRT.
Validate in JS instead, in convertALPNProtocols, so both client and
server fail early with a recoverable ERR_INVALID_ARG_VALUE:
- zero-length string protocols now throw from convertProtocols
- wire-format buffers are checked for zero-length and truncated
entries
- an empty buffer or array is still accepted and means skip ALPN,
matching the historical behavior for []
The C++ CHECK_EQ is left unchanged: once JS has validated the input,
a non-zero SSL_set_alpn_protos return is an internal invariant
failure rather than user-facing input.
Fixes: #65069
Signed-off-by: Sankalp Thakur <sankalphimself@gmail.com>
PR-URL: #65076
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>

Author: sankalpsthakur

lib/tls.js

@@ -251,6 +251,10 @@ function convertProtocols(protocols) {
 constlens=newArray(protocols.length);
 constbuff=Buffer.allocUnsafe(protocols.reduce((p,c,i)=>{
 constlen=Buffer.byteLength(c);
+if(len===0){
+thrownewERR_INVALID_ARG_VALUE(`protocols[${i}]`,c,
+'must be a non-empty string');
+}
 if(len>255){
 thrownewERR_OUT_OF_RANGE('The byte length of the protocol at index '+
 `${i} exceeds the maximum length.`,'<= 255',len,true);
@@ -269,18 +273,41 @@ function convertProtocols(protocols) {
 returnbuff;
 }
 
+functionvalidateALPNBuffer(buffer){
+// Wire format: sequence of <len><proto> where len is 1 byte (1-255) and
+// exactly len bytes follow, no trailing bytes, no zero-length entries.
+// Empty buffer is allowed and means skip ALPN (same as []).
+letoffset=0;
+while(offset<buffer.length){
+constlen=buffer[offset];
+if(len===0){
+thrownewERR_INVALID_ARG_VALUE('ALPNProtocols',buffer,
+'must not contain zero-length protocol');
+}
+if(offset+1+len>buffer.length){
+thrownewERR_INVALID_ARG_VALUE('ALPNProtocols',buffer,
+'contains truncated protocol');
+}
+offset+=1+len;
+}
+}
+
 exports.convertALPNProtocols=functionconvertALPNProtocols(protocols,out){
 // If protocols is Array - translate it into buffer
 if(ArrayIsArray(protocols)){
 out.ALPNProtocols=convertProtocols(protocols);
 }elseif(isUint8Array(protocols)){
 // Copy new buffer not to be modified by user.
-out.ALPNProtocols=Buffer.from(protocols);
+constbuf=Buffer.from(protocols);
+validateALPNBuffer(buf);
+out.ALPNProtocols=buf;
 }elseif(isArrayBufferView(protocols)){
-out.ALPNProtocols=Buffer.from(protocols.buffer.slice(
+constbuf=Buffer.from(protocols.buffer.slice(
 protocols.byteOffset,
 protocols.byteOffset+protocols.byteLength,
 ));
+validateALPNBuffer(buf);
+out.ALPNProtocols=buf;
 }
 };
 

test/parallel/test-tls-alpn-protocols-validation.js

@@ -0,0 +1,85 @@
+'use strict';
+constcommon=require('../common');
+if(!common.hasCrypto)
+common.skip('missing crypto');
+
+constassert=require('assert');
+consttls=require('tls');
+
+// Array with empty string should throw (zero-length protocol entry)
+assert.throws(()=>{
+constout={};
+tls.convertALPNProtocols([''],out);
+},{
+code: 'ERR_INVALID_ARG_VALUE',
+});
+
+// Array with empty string mixed
+assert.throws(()=>{
+constout={};
+tls.convertALPNProtocols(['h2',''],out);
+},{
+code: 'ERR_INVALID_ARG_VALUE',
+});
+
+// Buffer wire format with leading zero length
+assert.throws(()=>{
+constout={};
+tls.convertALPNProtocols(Buffer.from([0]),out);
+},{
+code: 'ERR_INVALID_ARG_VALUE',
+});
+
+// Buffer truncated (claims 2 bytes but only 1 follows)
+assert.throws(()=>{
+constout={};
+tls.convertALPNProtocols(Buffer.from([2,0x61]),out);
+},{
+code: 'ERR_INVALID_ARG_VALUE',
+});
+
+// Buffer with trailing invalid byte
+assert.throws(()=>{
+constout={};
+tls.convertALPNProtocols(Buffer.from([1,0x61,0x62,0x62]),out);
+},{
+code: 'ERR_INVALID_ARG_VALUE',
+});
+
+// Empty array means skip ALPN (allowed)
+{
+constout={};
+tls.convertALPNProtocols([],out);
+assert.ok(Buffer.isBuffer(out.ALPNProtocols));
+assert.strictEqual(out.ALPNProtocols.length,0);
+}
+
+// Empty buffer means skip ALPN (allowed; same as [])
+{
+constout={};
+tls.convertALPNProtocols(Buffer.alloc(0),out);
+assert.ok(Buffer.isBuffer(out.ALPNProtocols));
+assert.strictEqual(out.ALPNProtocols.length,0);
+}
+
+// Empty Uint8Array means skip ALPN
+{
+constout={};
+tls.convertALPNProtocols(newUint8Array(0),out);
+assert.ok(Buffer.isBuffer(out.ALPNProtocols));
+assert.strictEqual(out.ALPNProtocols.length,0);
+}
+
+// Valid inputs should not throw
+{
+constout={};
+tls.convertALPNProtocols(['h2','http/1.1'],out);
+assert.ok(out.ALPNProtocols.length>0);
+}
+{
+constout={};
+tls.convertALPNProtocols(Buffer.from([
+2,0x61,0x62,8,0x68,0x74,0x74,0x70,0x2f,0x31,0x2e,0x31,
+]),out);
+assert.strictEqual(out.ALPNProtocols.length,12);
+}

test/parallel/test-tls-basic-validations.js

@@ -81,17 +81,19 @@ assert.throws(() => tls.createServer({ ticketKeys: Buffer.alloc(0) }), {
 });
 
 {
-constbuffer=Buffer.from('abcd');
+constbuffer=Buffer.from([3,0x61,0x62,0x63]);
 constout={};
 tls.convertALPNProtocols(buffer,out);
-out.ALPNProtocols.write('efgh');
-assert(buffer.equals(Buffer.from('abcd')));
-assert(out.ALPNProtocols.equals(Buffer.from('efgh')));
+out.ALPNProtocols.write('def',1);
+assert(buffer.equals(Buffer.from([3,0x61,0x62,0x63])));
+assert(out.ALPNProtocols.equals(Buffer.from([3,0x64,0x65,0x66])));
 }
 
 {
-constarrayBufferViewStr='abcd';
-constinputBuffer=Buffer.from(arrayBufferViewStr.repeat(8),'utf8');
+constinputBuffer=Buffer.concat([
+Buffer.from([31]),
+Buffer.alloc(31,0x61),
+]);
 for(constexpectViewofcommon.getArrayBufferViews(inputBuffer)){
 constout={};
 constexpected=Buffer.from(expectView.buffer.slice(),

lib/tls.js

@@ -251,6 +251,10 @@ function convertProtocols(protocols) {
 constlens=newArray(protocols.length);
 constbuff=Buffer.allocUnsafe(protocols.reduce((p,c,i)=>{
 constlen=Buffer.byteLength(c);
+if(len===0){
+thrownewERR_INVALID_ARG_VALUE(`protocols[${i}]`,c,
+'must be a non-empty string');
+}
 if(len>255){
 thrownewERR_OUT_OF_RANGE('The byte length of the protocol at index '+
 `${i} exceeds the maximum length.`,'<= 255',len,true);
@@ -269,18 +273,41 @@ function convertProtocols(protocols) {
 returnbuff;
 }
 
+functionvalidateALPNBuffer(buffer){
+// Wire format: sequence of <len><proto> where len is 1 byte (1-255) and
+// exactly len bytes follow, no trailing bytes, no zero-length entries.
+// Empty buffer is allowed and means skip ALPN (same as []).
+letoffset=0;
+while(offset<buffer.length){
+constlen=buffer[offset];
+if(len===0){
+thrownewERR_INVALID_ARG_VALUE('ALPNProtocols',buffer,
+'must not contain zero-length protocol');
+}
+if(offset+1+len>buffer.length){
+thrownewERR_INVALID_ARG_VALUE('ALPNProtocols',buffer,
+'contains truncated protocol');
+}
+offset+=1+len;
+}
+}
+
 exports.convertALPNProtocols=functionconvertALPNProtocols(protocols,out){
 // If protocols is Array - translate it into buffer
 if(ArrayIsArray(protocols)){
 out.ALPNProtocols=convertProtocols(protocols);
 }elseif(isUint8Array(protocols)){
 // Copy new buffer not to be modified by user.
-out.ALPNProtocols=Buffer.from(protocols);
+constbuf=Buffer.from(protocols);
+validateALPNBuffer(buf);
+out.ALPNProtocols=buf;
 }elseif(isArrayBufferView(protocols)){
-out.ALPNProtocols=Buffer.from(protocols.buffer.slice(
+constbuf=Buffer.from(protocols.buffer.slice(
 protocols.byteOffset,
 protocols.byteOffset+protocols.byteLength,
 ));
+validateALPNBuffer(buf);
+out.ALPNProtocols=buf;
 }
 };
 

test/parallel/test-tls-alpn-protocols-validation.js

@@ -0,0 +1,85 @@
+'use strict';
+constcommon=require('../common');
+if(!common.hasCrypto)
+common.skip('missing crypto');
+
+constassert=require('assert');
+consttls=require('tls');
+
+// Array with empty string should throw (zero-length protocol entry)
+assert.throws(()=>{
+constout={};
+tls.convertALPNProtocols([''],out);
+},{
+code: 'ERR_INVALID_ARG_VALUE',
+});
+
+// Array with empty string mixed
+assert.throws(()=>{
+constout={};
+tls.convertALPNProtocols(['h2',''],out);
+},{
+code: 'ERR_INVALID_ARG_VALUE',
+});
+
+// Buffer wire format with leading zero length
+assert.throws(()=>{
+constout={};
+tls.convertALPNProtocols(Buffer.from([0]),out);
+},{
+code: 'ERR_INVALID_ARG_VALUE',
+});
+
+// Buffer truncated (claims 2 bytes but only 1 follows)
+assert.throws(()=>{
+constout={};
+tls.convertALPNProtocols(Buffer.from([2,0x61]),out);
+},{
+code: 'ERR_INVALID_ARG_VALUE',
+});
+
+// Buffer with trailing invalid byte
+assert.throws(()=>{
+constout={};
+tls.convertALPNProtocols(Buffer.from([1,0x61,0x62,0x62]),out);
+},{
+code: 'ERR_INVALID_ARG_VALUE',
+});
+
+// Empty array means skip ALPN (allowed)
+{
+constout={};
+tls.convertALPNProtocols([],out);
+assert.ok(Buffer.isBuffer(out.ALPNProtocols));
+assert.strictEqual(out.ALPNProtocols.length,0);
+}
+
+// Empty buffer means skip ALPN (allowed; same as [])
+{
+constout={};
+tls.convertALPNProtocols(Buffer.alloc(0),out);
+assert.ok(Buffer.isBuffer(out.ALPNProtocols));
+assert.strictEqual(out.ALPNProtocols.length,0);
+}
+
+// Empty Uint8Array means skip ALPN
+{
+constout={};
+tls.convertALPNProtocols(newUint8Array(0),out);
+assert.ok(Buffer.isBuffer(out.ALPNProtocols));
+assert.strictEqual(out.ALPNProtocols.length,0);
+}
+
+// Valid inputs should not throw
+{
+constout={};
+tls.convertALPNProtocols(['h2','http/1.1'],out);
+assert.ok(out.ALPNProtocols.length>0);
+}
+{
+constout={};
+tls.convertALPNProtocols(Buffer.from([
+2,0x61,0x62,8,0x68,0x74,0x74,0x70,0x2f,0x31,0x2e,0x31,
+]),out);
+assert.strictEqual(out.ALPNProtocols.length,12);
+}

test/parallel/test-tls-basic-validations.js

@@ -81,17 +81,19 @@ assert.throws(() => tls.createServer({ ticketKeys: Buffer.alloc(0) }), {
 });
 
 {
-constbuffer=Buffer.from('abcd');
+constbuffer=Buffer.from([3,0x61,0x62,0x63]);
 constout={};
 tls.convertALPNProtocols(buffer,out);
-out.ALPNProtocols.write('efgh');
-assert(buffer.equals(Buffer.from('abcd')));
-assert(out.ALPNProtocols.equals(Buffer.from('efgh')));
+out.ALPNProtocols.write('def',1);
+assert(buffer.equals(Buffer.from([3,0x61,0x62,0x63])));
+assert(out.ALPNProtocols.equals(Buffer.from([3,0x64,0x65,0x66])));
 }
 
 {
-constarrayBufferViewStr='abcd';
-constinputBuffer=Buffer.from(arrayBufferViewStr.repeat(8),'utf8');
+constinputBuffer=Buffer.concat([
+Buffer.from([31]),
+Buffer.alloc(31,0x61),
+]);
 for(constexpectViewofcommon.getArrayBufferViews(inputBuffer)){
 constout={};
 constexpected=Buffer.from(expectView.buffer.slice(),

lib/tls.js

@@ -251,6 +251,10 @@ function convertProtocols(protocols) {
 constlens=newArray(protocols.length);
 constbuff=Buffer.allocUnsafe(protocols.reduce((p,c,i)=>{
 constlen=Buffer.byteLength(c);
+if(len===0){
+thrownewERR_INVALID_ARG_VALUE(`protocols[${i}]`,c,
+'must be a non-empty string');
+}
 if(len>255){
 thrownewERR_OUT_OF_RANGE('The byte length of the protocol at index '+
 `${i} exceeds the maximum length.`,'<= 255',len,true);
@@ -269,18 +273,41 @@ function convertProtocols(protocols) {
 returnbuff;
 }
 
+functionvalidateALPNBuffer(buffer){
+// Wire format: sequence of <len><proto> where len is 1 byte (1-255) and
+// exactly len bytes follow, no trailing bytes, no zero-length entries.
+// Empty buffer is allowed and means skip ALPN (same as []).
+letoffset=0;
+while(offset<buffer.length){
+constlen=buffer[offset];
+if(len===0){
+thrownewERR_INVALID_ARG_VALUE('ALPNProtocols',buffer,
+'must not contain zero-length protocol');
+}
+if(offset+1+len>buffer.length){
+thrownewERR_INVALID_ARG_VALUE('ALPNProtocols',buffer,
+'contains truncated protocol');
+}
+offset+=1+len;
+}
+}
+
 exports.convertALPNProtocols=functionconvertALPNProtocols(protocols,out){
 // If protocols is Array - translate it into buffer
 if(ArrayIsArray(protocols)){
 out.ALPNProtocols=convertProtocols(protocols);
 }elseif(isUint8Array(protocols)){
 // Copy new buffer not to be modified by user.
-out.ALPNProtocols=Buffer.from(protocols);
+constbuf=Buffer.from(protocols);
+validateALPNBuffer(buf);
+out.ALPNProtocols=buf;
 }elseif(isArrayBufferView(protocols)){
-out.ALPNProtocols=Buffer.from(protocols.buffer.slice(
+constbuf=Buffer.from(protocols.buffer.slice(
 protocols.byteOffset,
 protocols.byteOffset+protocols.byteLength,
 ));
+validateALPNBuffer(buf);
+out.ALPNProtocols=buf;
 }
 };
 

test/parallel/test-tls-alpn-protocols-validation.js

@@ -0,0 +1,85 @@
+'use strict';
+constcommon=require('../common');
+if(!common.hasCrypto)
+common.skip('missing crypto');
+
+constassert=require('assert');
+consttls=require('tls');
+
+// Array with empty string should throw (zero-length protocol entry)
+assert.throws(()=>{
+constout={};
+tls.convertALPNProtocols([''],out);
+},{
+code: 'ERR_INVALID_ARG_VALUE',
+});
+
+// Array with empty string mixed
+assert.throws(()=>{
+constout={};
+tls.convertALPNProtocols(['h2',''],out);
+},{
+code: 'ERR_INVALID_ARG_VALUE',
+});
+
+// Buffer wire format with leading zero length
+assert.throws(()=>{
+constout={};
+tls.convertALPNProtocols(Buffer.from([0]),out);
+},{
+code: 'ERR_INVALID_ARG_VALUE',
+});
+
+// Buffer truncated (claims 2 bytes but only 1 follows)
+assert.throws(()=>{
+constout={};
+tls.convertALPNProtocols(Buffer.from([2,0x61]),out);
+},{
+code: 'ERR_INVALID_ARG_VALUE',
+});
+
+// Buffer with trailing invalid byte
+assert.throws(()=>{
+constout={};
+tls.convertALPNProtocols(Buffer.from([1,0x61,0x62,0x62]),out);
+},{
+code: 'ERR_INVALID_ARG_VALUE',
+});
+
+// Empty array means skip ALPN (allowed)
+{
+constout={};
+tls.convertALPNProtocols([],out);
+assert.ok(Buffer.isBuffer(out.ALPNProtocols));
+assert.strictEqual(out.ALPNProtocols.length,0);
+}
+
+// Empty buffer means skip ALPN (allowed; same as [])
+{
+constout={};
+tls.convertALPNProtocols(Buffer.alloc(0),out);
+assert.ok(Buffer.isBuffer(out.ALPNProtocols));
+assert.strictEqual(out.ALPNProtocols.length,0);
+}
+
+// Empty Uint8Array means skip ALPN
+{
+constout={};
+tls.convertALPNProtocols(newUint8Array(0),out);
+assert.ok(Buffer.isBuffer(out.ALPNProtocols));
+assert.strictEqual(out.ALPNProtocols.length,0);
+}
+
+// Valid inputs should not throw
+{
+constout={};
+tls.convertALPNProtocols(['h2','http/1.1'],out);
+assert.ok(out.ALPNProtocols.length>0);
+}
+{
+constout={};
+tls.convertALPNProtocols(Buffer.from([
+2,0x61,0x62,8,0x68,0x74,0x74,0x70,0x2f,0x31,0x2e,0x31,
+]),out);
+assert.strictEqual(out.ALPNProtocols.length,12);
+}

test/parallel/test-tls-basic-validations.js

@@ -81,17 +81,19 @@ assert.throws(() => tls.createServer({ ticketKeys: Buffer.alloc(0) }), {
 });
 
 {
-constbuffer=Buffer.from('abcd');
+constbuffer=Buffer.from([3,0x61,0x62,0x63]);
 constout={};
 tls.convertALPNProtocols(buffer,out);
-out.ALPNProtocols.write('efgh');
-assert(buffer.equals(Buffer.from('abcd')));
-assert(out.ALPNProtocols.equals(Buffer.from('efgh')));
+out.ALPNProtocols.write('def',1);
+assert(buffer.equals(Buffer.from([3,0x61,0x62,0x63])));
+assert(out.ALPNProtocols.equals(Buffer.from([3,0x64,0x65,0x66])));
 }
 
 {
-constarrayBufferViewStr='abcd';
-constinputBuffer=Buffer.from(arrayBufferViewStr.repeat(8),'utf8');
+constinputBuffer=Buffer.concat([
+Buffer.from([31]),
+Buffer.alloc(31,0x61),
+]);
 for(constexpectViewofcommon.getArrayBufferViews(inputBuffer)){
 constout={};
 constexpected=Buffer.from(expectView.buffer.slice(),

lib/tls.js

@@ -251,6 +251,10 @@ function convertProtocols(protocols) {
 constlens=newArray(protocols.length);
 constbuff=Buffer.allocUnsafe(protocols.reduce((p,c,i)=>{
 constlen=Buffer.byteLength(c);
+if(len===0){
+thrownewERR_INVALID_ARG_VALUE(`protocols[${i}]`,c,
+'must be a non-empty string');
+}
 if(len>255){
 thrownewERR_OUT_OF_RANGE('The byte length of the protocol at index '+
 `${i} exceeds the maximum length.`,'<= 255',len,true);
@@ -269,18 +273,41 @@ function convertProtocols(protocols) {
 returnbuff;
 }
 
+functionvalidateALPNBuffer(buffer){
+// Wire format: sequence of <len><proto> where len is 1 byte (1-255) and
+// exactly len bytes follow, no trailing bytes, no zero-length entries.
+// Empty buffer is allowed and means skip ALPN (same as []).
+letoffset=0;
+while(offset<buffer.length){
+constlen=buffer[offset];
+if(len===0){
+thrownewERR_INVALID_ARG_VALUE('ALPNProtocols',buffer,
+'must not contain zero-length protocol');
+}
+if(offset+1+len>buffer.length){
+thrownewERR_INVALID_ARG_VALUE('ALPNProtocols',buffer,
+'contains truncated protocol');
+}
+offset+=1+len;
+}
+}
+
 exports.convertALPNProtocols=functionconvertALPNProtocols(protocols,out){
 // If protocols is Array - translate it into buffer
 if(ArrayIsArray(protocols)){
 out.ALPNProtocols=convertProtocols(protocols);
 }elseif(isUint8Array(protocols)){
 // Copy new buffer not to be modified by user.
-out.ALPNProtocols=Buffer.from(protocols);
+constbuf=Buffer.from(protocols);
+validateALPNBuffer(buf);
+out.ALPNProtocols=buf;
 }elseif(isArrayBufferView(protocols)){
-out.ALPNProtocols=Buffer.from(protocols.buffer.slice(
+constbuf=Buffer.from(protocols.buffer.slice(
 protocols.byteOffset,
 protocols.byteOffset+protocols.byteLength,
 ));
+validateALPNBuffer(buf);
+out.ALPNProtocols=buf;
 }
 };
 

test/parallel/test-tls-alpn-protocols-validation.js

@@ -0,0 +1,85 @@
+'use strict';
+constcommon=require('../common');
+if(!common.hasCrypto)
+common.skip('missing crypto');
+
+constassert=require('assert');
+consttls=require('tls');
+
+// Array with empty string should throw (zero-length protocol entry)
+assert.throws(()=>{
+constout={};
+tls.convertALPNProtocols([''],out);
+},{
+code: 'ERR_INVALID_ARG_VALUE',
+});
+
+// Array with empty string mixed
+assert.throws(()=>{
+constout={};
+tls.convertALPNProtocols(['h2',''],out);
+},{
+code: 'ERR_INVALID_ARG_VALUE',
+});
+
+// Buffer wire format with leading zero length
+assert.throws(()=>{
+constout={};
+tls.convertALPNProtocols(Buffer.from([0]),out);
+},{
+code: 'ERR_INVALID_ARG_VALUE',
+});
+
+// Buffer truncated (claims 2 bytes but only 1 follows)
+assert.throws(()=>{
+constout={};
+tls.convertALPNProtocols(Buffer.from([2,0x61]),out);
+},{
+code: 'ERR_INVALID_ARG_VALUE',
+});
+
+// Buffer with trailing invalid byte
+assert.throws(()=>{
+constout={};
+tls.convertALPNProtocols(Buffer.from([1,0x61,0x62,0x62]),out);
+},{
+code: 'ERR_INVALID_ARG_VALUE',
+});
+
+// Empty array means skip ALPN (allowed)
+{
+constout={};
+tls.convertALPNProtocols([],out);
+assert.ok(Buffer.isBuffer(out.ALPNProtocols));
+assert.strictEqual(out.ALPNProtocols.length,0);
+}
+
+// Empty buffer means skip ALPN (allowed; same as [])
+{
+constout={};
+tls.convertALPNProtocols(Buffer.alloc(0),out);
+assert.ok(Buffer.isBuffer(out.ALPNProtocols));
+assert.strictEqual(out.ALPNProtocols.length,0);
+}
+
+// Empty Uint8Array means skip ALPN
+{
+constout={};
+tls.convertALPNProtocols(newUint8Array(0),out);
+assert.ok(Buffer.isBuffer(out.ALPNProtocols));
+assert.strictEqual(out.ALPNProtocols.length,0);
+}
+
+// Valid inputs should not throw
+{
+constout={};
+tls.convertALPNProtocols(['h2','http/1.1'],out);
+assert.ok(out.ALPNProtocols.length>0);
+}
+{
+constout={};
+tls.convertALPNProtocols(Buffer.from([
+2,0x61,0x62,8,0x68,0x74,0x74,0x70,0x2f,0x31,0x2e,0x31,
+]),out);
+assert.strictEqual(out.ALPNProtocols.length,12);
+}

test/parallel/test-tls-basic-validations.js

@@ -81,17 +81,19 @@ assert.throws(() => tls.createServer({ ticketKeys: Buffer.alloc(0) }), {
 });
 
 {
-constbuffer=Buffer.from('abcd');
+constbuffer=Buffer.from([3,0x61,0x62,0x63]);
 constout={};
 tls.convertALPNProtocols(buffer,out);
-out.ALPNProtocols.write('efgh');
-assert(buffer.equals(Buffer.from('abcd')));
-assert(out.ALPNProtocols.equals(Buffer.from('efgh')));
+out.ALPNProtocols.write('def',1);
+assert(buffer.equals(Buffer.from([3,0x61,0x62,0x63])));
+assert(out.ALPNProtocols.equals(Buffer.from([3,0x64,0x65,0x66])));
 }
 
 {
-constarrayBufferViewStr='abcd';
-constinputBuffer=Buffer.from(arrayBufferViewStr.repeat(8),'utf8');
+constinputBuffer=Buffer.concat([
+Buffer.from([31]),
+Buffer.alloc(31,0x61),
+]);
 for(constexpectViewofcommon.getArrayBufferViews(inputBuffer)){
 constout={};
 constexpected=Buffer.from(expectView.buffer.slice(),

lib/tls.js

@@ -251,6 +251,10 @@ function convertProtocols(protocols) {
 constlens=newArray(protocols.length);
 constbuff=Buffer.allocUnsafe(protocols.reduce((p,c,i)=>{
 constlen=Buffer.byteLength(c);
+if(len===0){
+thrownewERR_INVALID_ARG_VALUE(`protocols[${i}]`,c,
+'must be a non-empty string');
+}
 if(len>255){
 thrownewERR_OUT_OF_RANGE('The byte length of the protocol at index '+
 `${i} exceeds the maximum length.`,'<= 255',len,true);
@@ -269,18 +273,41 @@ function convertProtocols(protocols) {
 returnbuff;
 }
 
+functionvalidateALPNBuffer(buffer){
+// Wire format: sequence of <len><proto> where len is 1 byte (1-255) and
+// exactly len bytes follow, no trailing bytes, no zero-length entries.
+// Empty buffer is allowed and means skip ALPN (same as []).
+letoffset=0;
+while(offset<buffer.length){
+constlen=buffer[offset];
+if(len===0){
+thrownewERR_INVALID_ARG_VALUE('ALPNProtocols',buffer,
+'must not contain zero-length protocol');
+}
+if(offset+1+len>buffer.length){
+thrownewERR_INVALID_ARG_VALUE('ALPNProtocols',buffer,
+'contains truncated protocol');
+}
+offset+=1+len;
+}
+}
+
 exports.convertALPNProtocols=functionconvertALPNProtocols(protocols,out){
 // If protocols is Array - translate it into buffer
 if(ArrayIsArray(protocols)){
 out.ALPNProtocols=convertProtocols(protocols);
 }elseif(isUint8Array(protocols)){
 // Copy new buffer not to be modified by user.
-out.ALPNProtocols=Buffer.from(protocols);
+constbuf=Buffer.from(protocols);
+validateALPNBuffer(buf);
+out.ALPNProtocols=buf;
 }elseif(isArrayBufferView(protocols)){
-out.ALPNProtocols=Buffer.from(protocols.buffer.slice(
+constbuf=Buffer.from(protocols.buffer.slice(
 protocols.byteOffset,
 protocols.byteOffset+protocols.byteLength,
 ));
+validateALPNBuffer(buf);
+out.ALPNProtocols=buf;
 }
 };
 

test/parallel/test-tls-alpn-protocols-validation.js

@@ -0,0 +1,85 @@
+'use strict';
+constcommon=require('../common');
+if(!common.hasCrypto)
+common.skip('missing crypto');
+
+constassert=require('assert');
+consttls=require('tls');
+
+// Array with empty string should throw (zero-length protocol entry)
+assert.throws(()=>{
+constout={};
+tls.convertALPNProtocols([''],out);
+},{
+code: 'ERR_INVALID_ARG_VALUE',
+});
+
+// Array with empty string mixed
+assert.throws(()=>{
+constout={};
+tls.convertALPNProtocols(['h2',''],out);
+},{
+code: 'ERR_INVALID_ARG_VALUE',
+});
+
+// Buffer wire format with leading zero length
+assert.throws(()=>{
+constout={};
+tls.convertALPNProtocols(Buffer.from([0]),out);
+},{
+code: 'ERR_INVALID_ARG_VALUE',
+});
+
+// Buffer truncated (claims 2 bytes but only 1 follows)
+assert.throws(()=>{
+constout={};
+tls.convertALPNProtocols(Buffer.from([2,0x61]),out);
+},{
+code: 'ERR_INVALID_ARG_VALUE',
+});
+
+// Buffer with trailing invalid byte
+assert.throws(()=>{
+constout={};
+tls.convertALPNProtocols(Buffer.from([1,0x61,0x62,0x62]),out);
+},{
+code: 'ERR_INVALID_ARG_VALUE',
+});
+
+// Empty array means skip ALPN (allowed)
+{
+constout={};
+tls.convertALPNProtocols([],out);
+assert.ok(Buffer.isBuffer(out.ALPNProtocols));
+assert.strictEqual(out.ALPNProtocols.length,0);
+}
+
+// Empty buffer means skip ALPN (allowed; same as [])
+{
+constout={};
+tls.convertALPNProtocols(Buffer.alloc(0),out);
+assert.ok(Buffer.isBuffer(out.ALPNProtocols));
+assert.strictEqual(out.ALPNProtocols.length,0);
+}
+
+// Empty Uint8Array means skip ALPN
+{
+constout={};
+tls.convertALPNProtocols(newUint8Array(0),out);
+assert.ok(Buffer.isBuffer(out.ALPNProtocols));
+assert.strictEqual(out.ALPNProtocols.length,0);
+}
+
+// Valid inputs should not throw
+{
+constout={};
+tls.convertALPNProtocols(['h2','http/1.1'],out);
+assert.ok(out.ALPNProtocols.length>0);
+}
+{
+constout={};
+tls.convertALPNProtocols(Buffer.from([
+2,0x61,0x62,8,0x68,0x74,0x74,0x70,0x2f,0x31,0x2e,0x31,
+]),out);
+assert.strictEqual(out.ALPNProtocols.length,12);
+}

test/parallel/test-tls-basic-validations.js

@@ -81,17 +81,19 @@ assert.throws(() => tls.createServer({ ticketKeys: Buffer.alloc(0) }), {
 });
 
 {
-constbuffer=Buffer.from('abcd');
+constbuffer=Buffer.from([3,0x61,0x62,0x63]);
 constout={};
 tls.convertALPNProtocols(buffer,out);
-out.ALPNProtocols.write('efgh');
-assert(buffer.equals(Buffer.from('abcd')));
-assert(out.ALPNProtocols.equals(Buffer.from('efgh')));
+out.ALPNProtocols.write('def',1);
+assert(buffer.equals(Buffer.from([3,0x61,0x62,0x63])));
+assert(out.ALPNProtocols.equals(Buffer.from([3,0x64,0x65,0x66])));
 }
 
 {
-constarrayBufferViewStr='abcd';
-constinputBuffer=Buffer.from(arrayBufferViewStr.repeat(8),'utf8');
+constinputBuffer=Buffer.concat([
+Buffer.from([31]),
+Buffer.alloc(31,0x61),
+]);
 for(constexpectViewofcommon.getArrayBufferViews(inputBuffer)){
 constout={};
 constexpected=Buffer.from(expectView.buffer.slice(),

lib/tls.js

@@ -251,6 +251,10 @@ function convertProtocols(protocols) {
 constlens=newArray(protocols.length);
 constbuff=Buffer.allocUnsafe(protocols.reduce((p,c,i)=>{
 constlen=Buffer.byteLength(c);
+if(len===0){
+thrownewERR_INVALID_ARG_VALUE(`protocols[${i}]`,c,
+'must be a non-empty string');
+}
 if(len>255){
 thrownewERR_OUT_OF_RANGE('The byte length of the protocol at index '+
 `${i} exceeds the maximum length.`,'<= 255',len,true);
@@ -269,18 +273,41 @@ function convertProtocols(protocols) {
 returnbuff;
 }
 
+functionvalidateALPNBuffer(buffer){
+// Wire format: sequence of <len><proto> where len is 1 byte (1-255) and
+// exactly len bytes follow, no trailing bytes, no zero-length entries.
+// Empty buffer is allowed and means skip ALPN (same as []).
+letoffset=0;
+while(offset<buffer.length){
+constlen=buffer[offset];
+if(len===0){
+thrownewERR_INVALID_ARG_VALUE('ALPNProtocols',buffer,
+'must not contain zero-length protocol');
+}
+if(offset+1+len>buffer.length){
+thrownewERR_INVALID_ARG_VALUE('ALPNProtocols',buffer,
+'contains truncated protocol');
+}
+offset+=1+len;
+}
+}
+
 exports.convertALPNProtocols=functionconvertALPNProtocols(protocols,out){
 // If protocols is Array - translate it into buffer
 if(ArrayIsArray(protocols)){
 out.ALPNProtocols=convertProtocols(protocols);
 }elseif(isUint8Array(protocols)){
 // Copy new buffer not to be modified by user.
-out.ALPNProtocols=Buffer.from(protocols);
+constbuf=Buffer.from(protocols);
+validateALPNBuffer(buf);
+out.ALPNProtocols=buf;
 }elseif(isArrayBufferView(protocols)){
-out.ALPNProtocols=Buffer.from(protocols.buffer.slice(
+constbuf=Buffer.from(protocols.buffer.slice(
 protocols.byteOffset,
 protocols.byteOffset+protocols.byteLength,
 ));
+validateALPNBuffer(buf);
+out.ALPNProtocols=buf;
 }
 };
 

test/parallel/test-tls-alpn-protocols-validation.js

@@ -0,0 +1,85 @@
+'use strict';
+constcommon=require('../common');
+if(!common.hasCrypto)
+common.skip('missing crypto');
+
+constassert=require('assert');
+consttls=require('tls');
+
+// Array with empty string should throw (zero-length protocol entry)
+assert.throws(()=>{
+constout={};
+tls.convertALPNProtocols([''],out);
+},{
+code: 'ERR_INVALID_ARG_VALUE',
+});
+
+// Array with empty string mixed
+assert.throws(()=>{
+constout={};
+tls.convertALPNProtocols(['h2',''],out);
+},{
+code: 'ERR_INVALID_ARG_VALUE',
+});
+
+// Buffer wire format with leading zero length
+assert.throws(()=>{
+constout={};
+tls.convertALPNProtocols(Buffer.from([0]),out);
+},{
+code: 'ERR_INVALID_ARG_VALUE',
+});
+
+// Buffer truncated (claims 2 bytes but only 1 follows)
+assert.throws(()=>{
+constout={};
+tls.convertALPNProtocols(Buffer.from([2,0x61]),out);
+},{
+code: 'ERR_INVALID_ARG_VALUE',
+});
+
+// Buffer with trailing invalid byte
+assert.throws(()=>{
+constout={};
+tls.convertALPNProtocols(Buffer.from([1,0x61,0x62,0x62]),out);
+},{
+code: 'ERR_INVALID_ARG_VALUE',
+});
+
+// Empty array means skip ALPN (allowed)
+{
+constout={};
+tls.convertALPNProtocols([],out);
+assert.ok(Buffer.isBuffer(out.ALPNProtocols));
+assert.strictEqual(out.ALPNProtocols.length,0);
+}
+
+// Empty buffer means skip ALPN (allowed; same as [])
+{
+constout={};
+tls.convertALPNProtocols(Buffer.alloc(0),out);
+assert.ok(Buffer.isBuffer(out.ALPNProtocols));
+assert.strictEqual(out.ALPNProtocols.length,0);
+}
+
+// Empty Uint8Array means skip ALPN
+{
+constout={};
+tls.convertALPNProtocols(newUint8Array(0),out);
+assert.ok(Buffer.isBuffer(out.ALPNProtocols));
+assert.strictEqual(out.ALPNProtocols.length,0);
+}
+
+// Valid inputs should not throw
+{
+constout={};
+tls.convertALPNProtocols(['h2','http/1.1'],out);
+assert.ok(out.ALPNProtocols.length>0);
+}
+{
+constout={};
+tls.convertALPNProtocols(Buffer.from([
+2,0x61,0x62,8,0x68,0x74,0x74,0x70,0x2f,0x31,0x2e,0x31,
+]),out);
+assert.strictEqual(out.ALPNProtocols.length,12);
+}

test/parallel/test-tls-basic-validations.js

@@ -81,17 +81,19 @@ assert.throws(() => tls.createServer({ ticketKeys: Buffer.alloc(0) }), {
 });
 
 {
-constbuffer=Buffer.from('abcd');
+constbuffer=Buffer.from([3,0x61,0x62,0x63]);
 constout={};
 tls.convertALPNProtocols(buffer,out);
-out.ALPNProtocols.write('efgh');
-assert(buffer.equals(Buffer.from('abcd')));
-assert(out.ALPNProtocols.equals(Buffer.from('efgh')));
+out.ALPNProtocols.write('def',1);
+assert(buffer.equals(Buffer.from([3,0x61,0x62,0x63])));
+assert(out.ALPNProtocols.equals(Buffer.from([3,0x64,0x65,0x66])));
 }
 
 {
-constarrayBufferViewStr='abcd';
-constinputBuffer=Buffer.from(arrayBufferViewStr.repeat(8),'utf8');
+constinputBuffer=Buffer.concat([
+Buffer.from([31]),
+Buffer.alloc(31,0x61),
+]);
 for(constexpectViewofcommon.getArrayBufferViews(inputBuffer)){
 constout={};
 constexpected=Buffer.from(expectView.buffer.slice(),

lib/tls.js

@@ -251,6 +251,10 @@ function convertProtocols(protocols) {
 constlens=newArray(protocols.length);
 constbuff=Buffer.allocUnsafe(protocols.reduce((p,c,i)=>{
 constlen=Buffer.byteLength(c);
+if(len===0){
+thrownewERR_INVALID_ARG_VALUE(`protocols[${i}]`,c,
+'must be a non-empty string');
+}
 if(len>255){
 thrownewERR_OUT_OF_RANGE('The byte length of the protocol at index '+
 `${i} exceeds the maximum length.`,'<= 255',len,true);
@@ -269,18 +273,41 @@ function convertProtocols(protocols) {
 returnbuff;
 }
 
+functionvalidateALPNBuffer(buffer){
+// Wire format: sequence of <len><proto> where len is 1 byte (1-255) and
+// exactly len bytes follow, no trailing bytes, no zero-length entries.
+// Empty buffer is allowed and means skip ALPN (same as []).
+letoffset=0;
+while(offset<buffer.length){
+constlen=buffer[offset];
+if(len===0){
+thrownewERR_INVALID_ARG_VALUE('ALPNProtocols',buffer,
+'must not contain zero-length protocol');
+}
+if(offset+1+len>buffer.length){
+thrownewERR_INVALID_ARG_VALUE('ALPNProtocols',buffer,
+'contains truncated protocol');
+}
+offset+=1+len;
+}
+}
+
 exports.convertALPNProtocols=functionconvertALPNProtocols(protocols,out){
 // If protocols is Array - translate it into buffer
 if(ArrayIsArray(protocols)){
 out.ALPNProtocols=convertProtocols(protocols);
 }elseif(isUint8Array(protocols)){
 // Copy new buffer not to be modified by user.
-out.ALPNProtocols=Buffer.from(protocols);
+constbuf=Buffer.from(protocols);
+validateALPNBuffer(buf);
+out.ALPNProtocols=buf;
 }elseif(isArrayBufferView(protocols)){
-out.ALPNProtocols=Buffer.from(protocols.buffer.slice(
+constbuf=Buffer.from(protocols.buffer.slice(
 protocols.byteOffset,
 protocols.byteOffset+protocols.byteLength,
 ));
+validateALPNBuffer(buf);
+out.ALPNProtocols=buf;
 }
 };
 

test/parallel/test-tls-alpn-protocols-validation.js

@@ -0,0 +1,85 @@
+'use strict';
+constcommon=require('../common');
+if(!common.hasCrypto)
+common.skip('missing crypto');
+
+constassert=require('assert');
+consttls=require('tls');
+
+// Array with empty string should throw (zero-length protocol entry)
+assert.throws(()=>{
+constout={};
+tls.convertALPNProtocols([''],out);
+},{
+code: 'ERR_INVALID_ARG_VALUE',
+});
+
+// Array with empty string mixed
+assert.throws(()=>{
+constout={};
+tls.convertALPNProtocols(['h2',''],out);
+},{
+code: 'ERR_INVALID_ARG_VALUE',
+});
+
+// Buffer wire format with leading zero length
+assert.throws(()=>{
+constout={};
+tls.convertALPNProtocols(Buffer.from([0]),out);
+},{
+code: 'ERR_INVALID_ARG_VALUE',
+});
+
+// Buffer truncated (claims 2 bytes but only 1 follows)
+assert.throws(()=>{
+constout={};
+tls.convertALPNProtocols(Buffer.from([2,0x61]),out);
+},{
+code: 'ERR_INVALID_ARG_VALUE',
+});
+
+// Buffer with trailing invalid byte
+assert.throws(()=>{
+constout={};
+tls.convertALPNProtocols(Buffer.from([1,0x61,0x62,0x62]),out);
+},{
+code: 'ERR_INVALID_ARG_VALUE',
+});
+
+// Empty array means skip ALPN (allowed)
+{
+constout={};
+tls.convertALPNProtocols([],out);
+assert.ok(Buffer.isBuffer(out.ALPNProtocols));
+assert.strictEqual(out.ALPNProtocols.length,0);
+}
+
+// Empty buffer means skip ALPN (allowed; same as [])
+{
+constout={};
+tls.convertALPNProtocols(Buffer.alloc(0),out);
+assert.ok(Buffer.isBuffer(out.ALPNProtocols));
+assert.strictEqual(out.ALPNProtocols.length,0);
+}
+
+// Empty Uint8Array means skip ALPN
+{
+constout={};
+tls.convertALPNProtocols(newUint8Array(0),out);
+assert.ok(Buffer.isBuffer(out.ALPNProtocols));
+assert.strictEqual(out.ALPNProtocols.length,0);
+}
+
+// Valid inputs should not throw
+{
+constout={};
+tls.convertALPNProtocols(['h2','http/1.1'],out);
+assert.ok(out.ALPNProtocols.length>0);
+}
+{
+constout={};
+tls.convertALPNProtocols(Buffer.from([
+2,0x61,0x62,8,0x68,0x74,0x74,0x70,0x2f,0x31,0x2e,0x31,
+]),out);
+assert.strictEqual(out.ALPNProtocols.length,12);
+}

test/parallel/test-tls-basic-validations.js

@@ -81,17 +81,19 @@ assert.throws(() => tls.createServer({ ticketKeys: Buffer.alloc(0) }), {
 });
 
 {
-constbuffer=Buffer.from('abcd');
+constbuffer=Buffer.from([3,0x61,0x62,0x63]);
 constout={};
 tls.convertALPNProtocols(buffer,out);
-out.ALPNProtocols.write('efgh');
-assert(buffer.equals(Buffer.from('abcd')));
-assert(out.ALPNProtocols.equals(Buffer.from('efgh')));
+out.ALPNProtocols.write('def',1);
+assert(buffer.equals(Buffer.from([3,0x61,0x62,0x63])));
+assert(out.ALPNProtocols.equals(Buffer.from([3,0x64,0x65,0x66])));
 }
 
 {
-constarrayBufferViewStr='abcd';
-constinputBuffer=Buffer.from(arrayBufferViewStr.repeat(8),'utf8');
+constinputBuffer=Buffer.concat([
+Buffer.from([31]),
+Buffer.alloc(31,0x61),
+]);
 for(constexpectViewofcommon.getArrayBufferViews(inputBuffer)){
 constout={};
 constexpected=Buffer.from(expectView.buffer.slice(),

lib/tls.js

@@ -251,6 +251,10 @@ function convertProtocols(protocols) {
 constlens=newArray(protocols.length);
 constbuff=Buffer.allocUnsafe(protocols.reduce((p,c,i)=>{
 constlen=Buffer.byteLength(c);
+if(len===0){
+thrownewERR_INVALID_ARG_VALUE(`protocols[${i}]`,c,
+'must be a non-empty string');
+}
 if(len>255){
 thrownewERR_OUT_OF_RANGE('The byte length of the protocol at index '+
 `${i} exceeds the maximum length.`,'<= 255',len,true);
@@ -269,18 +273,41 @@ function convertProtocols(protocols) {
 returnbuff;
 }
 
+functionvalidateALPNBuffer(buffer){
+// Wire format: sequence of <len><proto> where len is 1 byte (1-255) and
+// exactly len bytes follow, no trailing bytes, no zero-length entries.
+// Empty buffer is allowed and means skip ALPN (same as []).
+letoffset=0;
+while(offset<buffer.length){
+constlen=buffer[offset];
+if(len===0){
+thrownewERR_INVALID_ARG_VALUE('ALPNProtocols',buffer,
+'must not contain zero-length protocol');
+}
+if(offset+1+len>buffer.length){
+thrownewERR_INVALID_ARG_VALUE('ALPNProtocols',buffer,
+'contains truncated protocol');
+}
+offset+=1+len;
+}
+}
+
 exports.convertALPNProtocols=functionconvertALPNProtocols(protocols,out){
 // If protocols is Array - translate it into buffer
 if(ArrayIsArray(protocols)){
 out.ALPNProtocols=convertProtocols(protocols);
 }elseif(isUint8Array(protocols)){
 // Copy new buffer not to be modified by user.
-out.ALPNProtocols=Buffer.from(protocols);
+constbuf=Buffer.from(protocols);
+validateALPNBuffer(buf);
+out.ALPNProtocols=buf;
 }elseif(isArrayBufferView(protocols)){
-out.ALPNProtocols=Buffer.from(protocols.buffer.slice(
+constbuf=Buffer.from(protocols.buffer.slice(
 protocols.byteOffset,
 protocols.byteOffset+protocols.byteLength,
 ));
+validateALPNBuffer(buf);
+out.ALPNProtocols=buf;
 }
 };
 

test/parallel/test-tls-alpn-protocols-validation.js

@@ -0,0 +1,85 @@
+'use strict';
+constcommon=require('../common');
+if(!common.hasCrypto)
+common.skip('missing crypto');
+
+constassert=require('assert');
+consttls=require('tls');
+
+// Array with empty string should throw (zero-length protocol entry)
+assert.throws(()=>{
+constout={};
+tls.convertALPNProtocols([''],out);
+},{
+code: 'ERR_INVALID_ARG_VALUE',
+});
+
+// Array with empty string mixed
+assert.throws(()=>{
+constout={};
+tls.convertALPNProtocols(['h2',''],out);
+},{
+code: 'ERR_INVALID_ARG_VALUE',
+});
+
+// Buffer wire format with leading zero length
+assert.throws(()=>{
+constout={};
+tls.convertALPNProtocols(Buffer.from([0]),out);
+},{
+code: 'ERR_INVALID_ARG_VALUE',
+});
+
+// Buffer truncated (claims 2 bytes but only 1 follows)
+assert.throws(()=>{
+constout={};
+tls.convertALPNProtocols(Buffer.from([2,0x61]),out);
+},{
+code: 'ERR_INVALID_ARG_VALUE',
+});
+
+// Buffer with trailing invalid byte
+assert.throws(()=>{
+constout={};
+tls.convertALPNProtocols(Buffer.from([1,0x61,0x62,0x62]),out);
+},{
+code: 'ERR_INVALID_ARG_VALUE',
+});
+
+// Empty array means skip ALPN (allowed)
+{
+constout={};
+tls.convertALPNProtocols([],out);
+assert.ok(Buffer.isBuffer(out.ALPNProtocols));
+assert.strictEqual(out.ALPNProtocols.length,0);
+}
+
+// Empty buffer means skip ALPN (allowed; same as [])
+{
+constout={};
+tls.convertALPNProtocols(Buffer.alloc(0),out);
+assert.ok(Buffer.isBuffer(out.ALPNProtocols));
+assert.strictEqual(out.ALPNProtocols.length,0);
+}
+
+// Empty Uint8Array means skip ALPN
+{
+constout={};
+tls.convertALPNProtocols(newUint8Array(0),out);
+assert.ok(Buffer.isBuffer(out.ALPNProtocols));
+assert.strictEqual(out.ALPNProtocols.length,0);
+}
+
+// Valid inputs should not throw
+{
+constout={};
+tls.convertALPNProtocols(['h2','http/1.1'],out);
+assert.ok(out.ALPNProtocols.length>0);
+}
+{
+constout={};
+tls.convertALPNProtocols(Buffer.from([
+2,0x61,0x62,8,0x68,0x74,0x74,0x70,0x2f,0x31,0x2e,0x31,
+]),out);
+assert.strictEqual(out.ALPNProtocols.length,12);
+}

test/parallel/test-tls-basic-validations.js

@@ -81,17 +81,19 @@ assert.throws(() => tls.createServer({ ticketKeys: Buffer.alloc(0) }), {
 });
 
 {
-constbuffer=Buffer.from('abcd');
+constbuffer=Buffer.from([3,0x61,0x62,0x63]);
 constout={};
 tls.convertALPNProtocols(buffer,out);
-out.ALPNProtocols.write('efgh');
-assert(buffer.equals(Buffer.from('abcd')));
-assert(out.ALPNProtocols.equals(Buffer.from('efgh')));
+out.ALPNProtocols.write('def',1);
+assert(buffer.equals(Buffer.from([3,0x61,0x62,0x63])));
+assert(out.ALPNProtocols.equals(Buffer.from([3,0x64,0x65,0x66])));
 }
 
 {
-constarrayBufferViewStr='abcd';
-constinputBuffer=Buffer.from(arrayBufferViewStr.repeat(8),'utf8');
+constinputBuffer=Buffer.concat([
+Buffer.from([31]),
+Buffer.alloc(31,0x61),
+]);
 for(constexpectViewofcommon.getArrayBufferViews(inputBuffer)){
 constout={};
 constexpected=Buffer.from(expectView.buffer.slice(),