From 4fc81e8ea091d9a61a3efbeb4f58e3c03dd09139 Mon Sep 17 00:00:00 2001
From: "Yukihiro \"Matz\" Matsumoto" <matz@ruby.or.jp>
Date: Mon, 29 Dec 2025 13:34:13 +0900
Subject: [PATCH] mruby-compiler: fix crash in pattern matching with string
 literal

The p_value grammar rule passed raw tSTRING token (a (len . str) cons
cell) directly to new_pat_value() without wrapping it as a proper AST
node. When codegen processed this malformed node, it read the length
field as the node type, causing misinterpretation and crash.

Wrap tSTRING with new_str(p, list1($1)) to create a proper NODE_STR,
consistent with how the primary:string rule handles strings.

Found by ClusterFuzz (oss-fuzz/mruby_fuzzer).

Co-authored-by: Claude <noreply@anthropic.com>
---
 mrbgems/mruby-compiler/core/parse.y | 2 +-
 mrbgems/mruby-compiler/core/y.tab.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/mrbgems/mruby-compiler/core/parse.y b/mrbgems/mruby-compiler/core/parse.y
index c45e179ab..0546b2a24 100644
--- a/mrbgems/mruby-compiler/core/parse.y
+++ b/mrbgems/mruby-compiler/core/parse.y
@@ -3986,7 +3986,7 @@ p_value         : p_var
                     }
                 | tSTRING
                     {
-                      $$ = new_pat_value(p, $1);
+                      $$ = new_pat_value(p, new_str(p, list1($1)));
                     }
                 | keyword_nil
                     {
diff --git a/mrbgems/mruby-compiler/core/y.tab.c b/mrbgems/mruby-compiler/core/y.tab.c
index ee314d4e3..8eacb67a8 100644
--- a/mrbgems/mruby-compiler/core/y.tab.c
+++ b/mrbgems/mruby-compiler/core/y.tab.c
@@ -10540,7 +10540,7 @@ yyreduce:
   case 456: /* p_value: tSTRING  */
 #line 3988 "mrbgems/mruby-compiler/core/parse.y"
                     {
-                      (yyval.nd) = new_pat_value(p, (yyvsp[0].nd));
+                      (yyval.nd) = new_pat_value(p, new_str(p, list1((yyvsp[0].nd))));
                     }
 #line 10546 "mrbgems/mruby-compiler/core/y.tab.c"
     break;