From 61b7653a02980be64ea4b44505bd40517dc69a24 Mon Sep 17 00:00:00 2001
From: rafael <rvalle@livelens.net>
Date: Tue, 13 Aug 2013 15:33:50 +0200
Subject: [PATCH] ensure that no value greater than 0xFF is written to a buffer
 position.

---
 lib/ber/writer.js | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/lib/ber/writer.js b/lib/ber/writer.js
index 7b445cc..eafbe9c 100644
--- a/lib/ber/writer.js
+++ b/lib/ber/writer.js
@@ -233,14 +233,14 @@ Writer.prototype.writeLength = function(len) {
     this._buf[this._offset++] = len;
   } else if (len <= 0xffff) {
     this._buf[this._offset++] = 0x82;
-    this._buf[this._offset++] = len >> 8;
-    this._buf[this._offset++] = len;
+    this._buf[this._offset++] = (len >> 8) & 0xff;
+    this._buf[this._offset++] = len & 0xff;
   } else if (len <= 0xffffff) {
     this._shift(start, len, 1);
     this._buf[this._offset++] = 0x83;
-    this._buf[this._offset++] = len >> 16;
-    this._buf[this._offset++] = len >> 8;
-    this._buf[this._offset++] = len;
+    this._buf[this._offset++] = (len >> 16) & 0xff;
+    this._buf[this._offset++] = (len >> 8) & 0xff;
+    this._buf[this._offset++] = len & 0xff;
   } else {
     throw new InvalidAsn1ERror('Length too long (> 4 bytes)');
   }
@@ -271,14 +271,14 @@ Writer.prototype.endSequence = function() {
     this._buf[seq + 1] = len;
   } else if (len <= 0xffff) {
     this._buf[seq] = 0x82;
-    this._buf[seq + 1] = len >> 8;
-    this._buf[seq + 2] = len;
+    this._buf[seq + 1] = (len >> 8) & 0xff;
+    this._buf[seq + 2] = len & 0xff;
   } else if (len <= 0xffffff) {
     this._shift(start, len, 1);
     this._buf[seq] = 0x83;
-    this._buf[seq + 1] = len >> 16;
-    this._buf[seq + 2] = len >> 8;
-    this._buf[seq + 3] = len;
+    this._buf[seq + 1] = (len >> 16) & 0xff;
+    this._buf[seq + 2] = (len >> 8) & 0xff;
+    this._buf[seq + 3] = len & 0xff;
   } else {
     throw new InvalidAsn1Error('Sequence too long');
   }