Index: src/api.cc |
diff --git a/src/api.cc b/src/api.cc |
index e8ab5a7bce22ad1ee7906dc14a7f9fe510327904..bb343b5be805cd5ba666cee1877bc7dd6fc37fc0 100644 |
--- a/src/api.cc |
+++ b/src/api.cc |
@@ -3404,7 +3404,7 @@ void v8::Object::SetIndexedPropertiesToPixelData(uint8_t* data, int length) { |
ON_BAILOUT(isolate, "v8::SetElementsToPixelData()", return); |
ENTER_V8(isolate); |
i::HandleScope scope(isolate); |
- if (!ApiCheck(length <= i::ExternalPixelArray::kMaxLength, |
+ if (!ApiCheck(length >= 0 && length <= i::ExternalPixelArray::kMaxLength, |
"v8::Object::SetIndexedPropertiesToPixelData()", |
"length exceeds max acceptable value")) { |
return; |
@@ -3460,7 +3460,7 @@ void v8::Object::SetIndexedPropertiesToExternalArrayData( |
ON_BAILOUT(isolate, "v8::SetIndexedPropertiesToExternalArrayData()", return); |
ENTER_V8(isolate); |
i::HandleScope scope(isolate); |
- if (!ApiCheck(length <= i::ExternalArray::kMaxLength, |
+ if (!ApiCheck(length >= 0 && length <= i::ExternalArray::kMaxLength, |
"v8::Object::SetIndexedPropertiesToExternalArrayData()", |
"length exceeds max acceptable value")) { |
return; |