Commit b3b8c01

and

committed

load.c: fix off-by-one in bounds check for symbol names

Same issue as the pool string fix: the bounds check for symbol names only validated snl bytes, but the binary format includes a null terminator. The source pointer advances by snl+1, so the check must account for it. Co-authored-by: Claude <noreply@anthropic.com>

1 file changed

Lines changed: 1 addition & 1 deletion

File tree

Lines changed: 1 addition & 1 deletion

Original file line number	Diff line number	Diff line change
`@@ -231,7 +231,7 @@ read_irep_record_1(mrb_state mrb, const uint8_t bin, const uint8_t *end, size_`
`231`	`231`	`continue;`
`232`	`232`	`}`
`233`	`233`
`234`		`-if (src + snl > end) return FALSE;`
	`234`	`+if (src + snl + 1 > end) return FALSE;`
`235`	`235`	`if (flags & FLAG_SRC_MALLOC) {`
`236`	`236`	`syms[i] = mrb_intern(mrb, (char*)src, snl);`
`237`	`237`	`}`

0 commit comments

Comments

(0)