Merge pull request #4551 from dearblue/fix-4549

Fix heap buffer overflow; ref #4549

src/string.c

@@ -1184,7 +1184,7 @@ str_replace_partial(mrb_state *mrb, mrb_value src, mrb_int pos, mrb_int end, mrb
 
   mrb_str_modify(mrb, str);
 
-  if (len < newlen || len - newlen >= shrink_threshold) {
+  if (len < newlen) {
     resize_capa(mrb, str, newlen);
   }
 
@@ -1197,6 +1197,10 @@ str_replace_partial(mrb_state *mrb, mrb_value src, mrb_int pos, mrb_int end, mrb
   RSTR_SET_LEN(str, newlen);
   strp[newlen] = '\0';
 
+  if (len - newlen >= shrink_threshold) {
+    resize_capa(mrb, str, newlen);
+  }
+
   return src;
 }