From 6afff1c3ebeffeb355353d50d613f0db3b9e36d7 Mon Sep 17 00:00:00 2001
From: "Yukihiro \"Matz\" Matsumoto" <matz@ruby.or.jp>
Date: Fri, 6 Feb 2026 16:31:34 +0900
Subject: [PATCH] string.c: fix integer overflow in str_check_length()

Reject MRB_INT_MAX length strings to prevent signed integer overflow
when adding 1 for the null terminator in str_init_normal_capa() and
resize_capa().

Co-authored-by: Claude <noreply@anthropic.com>
---
 src/string.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/string.c b/src/string.c
index a0dee0f85..0cab3d80e 100644
--- a/src/string.c
+++ b/src/string.c
@@ -40,7 +40,7 @@ const char mrb_digitmap[] = "0123456789abcdefghijklmnopqrstuvwxyz";
 static void
 str_check_length(mrb_state *mrb, mrb_int len)
 {
-  if (len < 0) {
+  if (len < 0 || len == MRB_INT_MAX) {
     mrb_raise(mrb, E_ARGUMENT_ERROR, "negative (or overflowed) string size");
   }
 #if MRB_STR_LENGTH_MAX != 0