From f80f1cd27d60f964df5ee577ad3bf6e96d3b634e Mon Sep 17 00:00:00 2001 From: "Yukihiro \"Matz\" Matsumoto" Date: Tue, 10 Feb 2026 14:56:12 +0900 Subject: [PATCH] load.c: fix off-by-one in bounds check for pool strings The bounds check for IREP_TT_STR pool data only validated pool_data_len bytes, but the binary format includes a null terminator after the string content. Both memcpy and the source pointer advance by pool_data_len+1, so the check must account for the extra byte. Co-authored-by: Claude --- src/load.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/load.c b/src/load.c index ac850373d..49f6580b4 100644 --- a/src/load.c +++ b/src/load.c @@ -189,7 +189,7 @@ read_irep_record_1(mrb_state *mrb, const uint8_t *bin, const uint8_t *end, size_ case IREP_TT_STR: pool_data_len = bin_to_uint16(src); /* pool data length */ src += sizeof(uint16_t); - if (src + pool_data_len > end) return FALSE; + if (src + pool_data_len + 1 > end) return FALSE; if (st) { pool[i].tt = (pool_data_len<<2) | IREP_TT_SSTR; pool[i].u.str = (const char*)src;