string.c: fix integer overflow in str_check_length()

Reject MRB_INT_MAX length strings to prevent signed integer overflow
when adding 1 for the null terminator in str_init_normal_capa() and
resize_capa().

Co-authored-by: Claude <noreply@anthropic.com>
This commit is contained in:
Yukihiro "Matz" Matsumoto
2026-02-06 16:31:34 +09:00
parent b287c12e48
commit 6afff1c3eb
+1 -1
View File
@@ -40,7 +40,7 @@ const char mrb_digitmap[] = "0123456789abcdefghijklmnopqrstuvwxyz";
static void
str_check_length(mrb_state *mrb, mrb_int len)
{
if (len < 0) {
if (len < 0 || len == MRB_INT_MAX) {
mrb_raise(mrb, E_ARGUMENT_ERROR, "negative (or overflowed) string size");
}
#if MRB_STR_LENGTH_MAX != 0