buffer: validate copyArrayBuffer offsets against buffer length

[iliaal]

CopyArrayBuffer() computed byteLength - offset in unsigned arithmetic before its CHECK_GE bounds check. An offset greater than the buffer length wrapped the subtraction to a near-SIZE_MAX value, so the check passed and memcpy() copied out of bounds.

The only in-tree caller is the Web Streams BYOB reader, which validates the offsets in JS via canCopyArrayBuffer() before calling. The binding is also reachable directly through process.binding('buffer').copyArrayBuffer(...), which bypasses that guard, so the offsets reach C++ unchecked. Only in-process (trusted) code can reach it, so this is a robustness fix, not a vulnerability.

Validate the destination and source ranges in C++ and throw ERR_OUT_OF_RANGE, as the other range checks in node_buffer.cc already do.

Reproduction before the change (in-process JS, no flags):

const b = process.binding('buffer');
b.copyArrayBuffer(new ArrayBuffer(1024), 1025, new ArrayBuffer(8), 0, 8);
// writes 8 bytes past the destination, corrupting the adjacent heap chunk

After the change the call throws ERR_OUT_OF_RANGE.

[Renegade334]

The caller validates the arguments here, we do not provide guardrails for invoking C++ internals from userland.

That being said, an additional assertion to cover the invariant you've mentioned (eg. CHECK_LE(destination_offset, destination_byte_length) wouldn't go amiss.