From 8b213c4fbf0d7c0189c44aee7e4182c0b317181e Mon Sep 17 00:00:00 2001
From: "Yukihiro \"Matz\" Matsumoto" <matz@ruby.or.jp>
Date: Tue, 15 Apr 2025 07:11:09 +0900
Subject: [PATCH] string.c (sub_replace): check if `found` argument is within
 proper range

Since it is an internal method, we didn't check the argument range, but
if it's called directly, out-of-range argument could cause SEGV.
---
 src/string.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/src/string.c b/src/string.c
index abb8b4e36..df7363d3d 100644
--- a/src/string.c
+++ b/src/string.c
@@ -3046,6 +3046,9 @@ sub_replace(mrb_state *mrb, mrb_value self)
   mrb_value result;
 
   mrb_get_args(mrb, "ssi", &p, &plen, &match, &mlen, &found);
+  if (found < 0 || RSTRING_LEN(self) < found) {
+    mrb_raise(mrb, E_RUNTIME_ERROR, "argument out of range");
+  }
   result = mrb_str_new(mrb, 0, 0);
   for (mrb_int i=0; i<plen; i++) {
     if (p[i] != '\\' || i+1==plen) {