From 76fc6e9ace55bb334df1ec6888dd62b8fbb659a5 Mon Sep 17 00:00:00 2001
From: dearblue <dearblue@users.osdn.me>
Date: Wed, 26 Feb 2025 21:22:37 +0900
Subject: [PATCH] Fixed buffer overrun in function `chars2bytes()`

If `off` was greater than zero, the address pointed to by `e` exceeded the valid range of the buffer.
---
 src/string.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/src/string.c b/src/string.c
index 849f5c65a..24e0959cc 100644
--- a/src/string.c
+++ b/src/string.c
@@ -465,9 +465,10 @@ chars2bytes(mrb_value str, mrb_int off, mrb_int idx)
     return idx;
   }
 
-  const char *p0 = RSTR_PTR(s) + off;
+  const char *o = RSTR_PTR(s);
+  const char *p0 = o + off;
   const char *p = p0;
-  const char *e = p0 + RSTR_LEN(s);
+  const char *e = o + RSTR_LEN(s);
   mrb_int i = 0;
 
   while (p<e && i<idx) {