From 868aeaf48c07479c0a33fb74b8886ae5bd6095f9 Mon Sep 17 00:00:00 2001
From: "Yukihiro \"Matz\" Matsumoto" <matz@ruby.or.jp>
Date: Fri, 9 Feb 2024 18:52:44 +0900
Subject: [PATCH] string.c (memsearch_swar): fixed a buffer overflow

---
 src/string.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/src/string.c b/src/string.c
index 05fa1dbd0..19b5f9f39 100644
--- a/src/string.c
+++ b/src/string.c
@@ -644,8 +644,9 @@ memsearch_swar(const char *xs, long m, const char *ys, long n)
     const char *p = s0;
     const char *e = ys + n;
     for (;p<e;) {
-      p = (const char*)memchr(p, *xs, e-p);
-      if (p == NULL) break;
+      size_t len = e-p;
+      p = (const char*)memchr(p, *xs, len);
+      if (p == NULL || len < m) break;
       if (memcmp(p+1, xs+1, m-1) == 0) return (mrb_int)(p - ys);
       p++;
     }