v8.deserialize: Fix out of bounds write

[arneg]

When v8.deserialized is passed a Buffer with non-zero byteOffset, it will call copy and try to copy more bytes than are allocated in the destination buffer. This will then call the SlowCopy method which will call memmove and write bytes after the buffer.

This crash has been observed with the parcel tool.

[arneg]

While debugging this I also ended up adding this check to SlowCopy

CHECK(to_copy <= (target_length - target_start));

Is it worth adding checks like that?

[arneg]

PR #55261 is an attempt to fix the same issue.

[avivkeller]

@ronag is this a duplicate of your PR? If so, feel free to close it as such :-)

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 88.40%. Comparing base (d2ad9b4) to head (b61f85b).
Report is 11 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #55269      +/-   ##
==========================================
- Coverage   88.41%   88.40%   -0.02%     
==========================================
  Files         652      652              
  Lines      186594   186589       -5     
  Branches    36054    36060       +6     
==========================================
- Hits       164980   164954      -26     
- Misses      14883    14900      +17     
- Partials     6731     6735       +4     

Files with missing lines	Coverage Δ
lib/v8.js	99.32% <100.00%> (ø)

... and 24 files with indirect coverage changes

[arneg]

PR #55261 fixes the same issue and is hopefully merged soon.