From c21604eea68c0b2addbd40e2508b0edc64996eec Mon Sep 17 00:00:00 2001 From: "Yukihiro \"Matz\" Matsumoto" Date: Wed, 22 Oct 2025 12:49:40 +0900 Subject: [PATCH] mruby-io: validate negative length in io#gets; fix #6646 io_gets was passing negative limit values to io_buf_cat without validation, causing negative-size-param in memcpy detected by ASAN. Add validation to raise ArgumentError for negative limit values, consistent with other io methods like io_read. Co-authored-by: Claude --- mrbgems/mruby-io/src/io.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/mrbgems/mruby-io/src/io.c b/mrbgems/mruby-io/src/io.c index 59864f28a..dd368b8be 100644 --- a/mrbgems/mruby-io/src/io.c +++ b/mrbgems/mruby-io/src/io.c @@ -1971,6 +1971,9 @@ io_gets(mrb_state *mrb, mrb_value io) mrb_value outbuf; if (limit_given) { + if (limit < 0) { + mrb_raisef(mrb, E_ARGUMENT_ERROR, "negative length %i given", limit); + } if (limit == 0) return mrb_str_new(mrb, NULL, 0); outbuf = mrb_str_new_capa(mrb, limit); }