From ce15c9a04cd5891337f6532721bfbca029e42121 Mon Sep 17 00:00:00 2001
From: asynts <asynts@gmail.com>
Date: Wed, 9 Dec 2020 15:10:33 +0100
Subject: [PATCH] AK: Fix unsigned integer underflow in
 DuplexMemoryStream::write.

---
 AK/Forward.h                  | 9 +++++++++
 AK/MemoryStream.h             | 2 +-
 AK/Tests/TestMemoryStream.cpp | 8 ++++++++
 3 files changed, 18 insertions(+), 1 deletion(-)

diff --git a/AK/Forward.h b/AK/Forward.h
index c1dccb3f55..1224a42480 100644
--- a/AK/Forward.h
+++ b/AK/Forward.h
@@ -133,6 +133,15 @@ class WeakPtr;
 template<typename T, size_t inline_capacity = 0>
 class Vector;
 
+template<typename... Parameters>
+void dbgln(const char* fmtstr, const Parameters&...);
+
+template<typename... Parameters>
+void warnln(const char* fmtstr, const Parameters&...);
+
+template<typename... Parameters>
+void outln(const char* fmtstr, const Parameters&...);
+
 }
 
 using AK::Array;
diff --git a/AK/MemoryStream.h b/AK/MemoryStream.h
index d4cff6bfce..f701115ddb 100644
--- a/AK/MemoryStream.h
+++ b/AK/MemoryStream.h
@@ -289,7 +289,7 @@ public:
             if ((m_write_offset + nwritten) % chunk_size == 0)
                 m_chunks.append(ByteBuffer::create_uninitialized(chunk_size));
 
-            nwritten += bytes.copy_trimmed_to(m_chunks.last().bytes().slice(m_write_offset % chunk_size));
+            nwritten += bytes.slice(nwritten).copy_trimmed_to(m_chunks.last().bytes().slice(m_write_offset % chunk_size));
         }
 
         m_write_offset += nwritten;
diff --git a/AK/Tests/TestMemoryStream.cpp b/AK/Tests/TestMemoryStream.cpp
index 766c1690c8..e8cdfa6356 100644
--- a/AK/Tests/TestMemoryStream.cpp
+++ b/AK/Tests/TestMemoryStream.cpp
@@ -208,4 +208,12 @@ TEST_CASE(offset_of_out_of_bounds)
     EXPECT(!stream.offset_of(target).has_value());
 }
 
+TEST_CASE(unsigned_integer_underflow_regression)
+{
+    Array<u8, DuplexMemoryStream::chunk_size + 1> buffer;
+
+    DuplexMemoryStream stream;
+    stream << buffer;
+}
+
 TEST_MAIN(MemoryStream)