From b3b8c0176fbd4cf463f91967012c446e5b9707d3 Mon Sep 17 00:00:00 2001 From: "Yukihiro \"Matz\" Matsumoto" Date: Tue, 10 Feb 2026 14:56:25 +0900 Subject: [PATCH] load.c: fix off-by-one in bounds check for symbol names Same issue as the pool string fix: the bounds check for symbol names only validated snl bytes, but the binary format includes a null terminator. The source pointer advances by snl+1, so the check must account for it. Co-authored-by: Claude --- src/load.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/load.c b/src/load.c index 49f6580b4..6f9954b82 100644 --- a/src/load.c +++ b/src/load.c @@ -231,7 +231,7 @@ read_irep_record_1(mrb_state *mrb, const uint8_t *bin, const uint8_t *end, size_ continue; } - if (src + snl > end) return FALSE; + if (src + snl + 1 > end) return FALSE; if (flags & FLAG_SRC_MALLOC) { syms[i] = mrb_intern(mrb, (char*)src, snl); }