buffer: optimize buffer.concat performance

PR-URL: #61721
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>

Author: mertcanaltin

lib/buffer.js

@@ -51,6 +51,7 @@ const {
  TypedArrayPrototypeGetLength,
  TypedArrayPrototypeSet,
  TypedArrayPrototypeSlice,
+ TypedArrayPrototypeSubarray,
  Uint8Array,
  Uint8ArrayPrototype,
 }=primordials;
@@ -588,25 +589,55 @@ Buffer.concat = function concat(list, length) {
 if(length===undefined){
 length=0;
 for(leti=0;i<list.length;i++){
-if(list[i].length){
-length+=list[i].length;
+constbuf=list[i];
+if(!isUint8Array(buf)){
+// TODO(BridgeAR): This should not be of type ERR_INVALID_ARG_TYPE.
+// Instead, find the proper error code for this.
+thrownewERR_INVALID_ARG_TYPE(
+`list[${i}]`,['Buffer','Uint8Array'],buf);
 }
+length+=TypedArrayPrototypeGetByteLength(buf);
 }
-}else{
-validateOffset(length,'length');
+
+constbuffer=allocate(length);
+letpos=0;
+for(leti=0;i<list.length;i++){
+constbuf=list[i];
+constbufLength=TypedArrayPrototypeGetByteLength(buf);
+TypedArrayPrototypeSet(buffer,buf,pos);
+pos+=bufLength;
+}
+
+if(pos<length){
+TypedArrayPrototypeFill(buffer,0,pos,length);
+}
+returnbuffer;
 }
 
-constbuffer=Buffer.allocUnsafe(length);
-letpos=0;
+validateOffset(length,'length');
 for(leti=0;i<list.length;i++){
-constbuf=list[i];
-if(!isUint8Array(buf)){
+if(!isUint8Array(list[i])){
 // TODO(BridgeAR): This should not be of type ERR_INVALID_ARG_TYPE.
 // Instead, find the proper error code for this.
 thrownewERR_INVALID_ARG_TYPE(
 `list[${i}]`,['Buffer','Uint8Array'],list[i]);
 }
-pos+=_copyActual(buf,buffer,pos,0,buf.length,true);
+}
+
+constbuffer=allocate(length);
+letpos=0;
+for(leti=0;i<list.length;i++){
+constbuf=list[i];
+constbufLength=TypedArrayPrototypeGetByteLength(buf);
+if(pos+bufLength>length){
+TypedArrayPrototypeSet(buffer,
+TypedArrayPrototypeSubarray(buf,0,length-pos),
+pos);
+pos=length;
+break;
+}
+TypedArrayPrototypeSet(buffer,buf,pos);
+pos+=bufLength;
 }
 
 // Note: `length` is always equal to `buffer.length` at this point

test/parallel/test-buffer-concat.js

@@ -106,3 +106,13 @@ assert.deepStrictEqual(
 assert.deepStrictEqual(Buffer.concat([newUint8Array([0x41,0x42]),
 newUint8Array([0x43,0x44])]),
 Buffer.from('ABCD'));
+
+// Spoofed length getter should not cause uninitialized memory exposure
+{
+constu8_1=newUint8Array([1,2,3,4]);
+constu8_2=newUint8Array([5,6,7,8]);
+Object.defineProperty(u8_1,'length',{get(){return100;}});
+constbuf=Buffer.concat([u8_1,u8_2]);
+assert.strictEqual(buf.length,8);
+assert.deepStrictEqual(buf,Buffer.from([1,2,3,4,5,6,7,8]));
+}