bl.append(number) appends a buffer with uninitialized memory

[feross]

This PR changes the behavior of bl.append(number) so that it no longer appends a buffer with uninitialized memory of the specified size.

The issue is fixed by coercing the argument to a string. (An alternate solution would be to throw an exception in this case.)

This played a role in this issue in request: request/request#2018

Further reading:

• Buffer(number) is unsafe nodejs/node#4660
• Buffer.from/Buffer.alloc/Buffer.zalloc/Buffer() soft-deprecate nodejs/node-eps#4

[rvagg]

newline, == instead of === please

[rvagg]

comment would also be good

[rvagg]

lgtm sans syntax issues

[feross]

@rvagg thanks, fixed as requested :)

[rvagg]

Published as v1.0.1, backported and released as v0.9.5 too, but tbh I have no idea how much that's used. I would have done v0.8 but it doesn't apply cleanly for reasons that suggest that you probably shouldn't be using v0.8 anyway.

Thanks @feross.

[feross]

Nice work. Thanks for going above-and-beyond by backporting to pre-1.0.

[mcollina]

👍, nice!