buffer: harden validation of buffer allocation size

This makes using `NaN` as the buffer size throw an error.

Fixes: https://github.com/nodejs/node/issues/26151

PR-URL: https://github.com/nodejs/node/pull/26162
Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Сковорода Никита Андреевич <chalkerx@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>

lib/buffer.js

@@ -256,7 +256,7 @@ function assertSize(size) {
 
   if (typeof size !== 'number') {
     err = new ERR_INVALID_ARG_TYPE('size', 'number', size);
-  } else if (size < 0 || size > kMaxLength) {
+  } else if (!(size >= 0 && size <= kMaxLength)) {
     err = new ERR_INVALID_OPT_VALUE.RangeError('size', size);
   }
 
@@ -458,8 +458,11 @@ Buffer.concat = function concat(list, length) {
 
   if (length === undefined) {
     length = 0;
-    for (i = 0; i < list.length; i++)
-      length += list[i].length;
+    for (i = 0; i < list.length; i++) {
+      if (list[i].length) {
+        length += list[i].length;
+      }
+    }
   } else {
     length = length >>> 0;
   }