🩺 Stability & Availability | 🟠 Major | ⚡ Quick win

#!/bin/sh
set -eu

rg -n -C 4 'uintptr_t|RSTR_CAPA|RSTR_PTR\(s\)|ptrdiff_t off' \
  src/string.c include/mruby

#!/bin/bash
set -eu

printf '--- files ---\n'
git ls-files | rg '(^|/)(README|.*\.md|.*\.txt|CMakeLists\.txt|Makefile|\.clang.*|.*\.inc|.*\.h)$' | head -100 || true

printf '\n--- mrb_str_cat and call sites ---\n'
rg -n -C 3 '\bmrb_str_cat\(|mrb_str_cat_' -- .

printf '\n--- pointer relational/subtraction patterns around RSTR_PTR ---\n'
rg -n -C 2 '\b(ptr|p|end|boundary|mrb_str_ptr).*[><]=|[><=].*(ptr|p|end|boundary|mrb_str_ptr)|ptr - RSTR_PTR\(|RSTR_PTR\(s\) -|RSTRING_PTR\(str0\)' src/include include src string.c -g '*.[ch]' | head -250

#!/bin/bash
set -eu

printf '%s\n' '--- files ---'
git ls-files | rg '(^|/)(README|.*\.md|.*\.txt|CMakeLists\.txt|Makefile|\.clang.*|.*\.inc|.*\.h)$' | head -100 || true

printf '%s\n'
printf '%s\n' '--- mrb_str_cat and call sites ---'
rg -n -C 3 '\bmrb_str_cat\(|mrb_str_cat_' -- .

printf '%s\n'
printf '%s\n' '--- pointer relational/subtraction patterns around RSTR_PTR ---'
rg -n -C 2 '\b(ptr|p|end|boundary|mrb_str_ptr).*[><]=|[><=].*(ptr|p|end|boundary|mrb_str_ptr)|ptr - RSTR_PTR\(|RSTR_PTR\(s\) -|RSTRING_PTR\(str0\)' src include -g '*.[ch]' | head -250 || true

Use integer address math before modifying str.

mrb_str_cat() accepts pointers from any object. In src/string.c:3144-3145, comparing/subtracting ptr against RSTR_PTR(s) before mrb_str_modify() can compare unrelated pointers. Use uintptr_t arithmetic for the containment check before mrb_str_modify() moves the string buffer.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/string.c` around lines 3144 - 3146, Update the pointer containment and
offset calculation in mrb_str_cat to convert ptr and RSTR_PTR(s) to uintptr_t
before comparing or subtracting, avoiding unrelated-pointer operations while
preserving the existing length bounds and computed off value before
mrb_str_modify().

The comparison this points at is not introduced here. Master carries the same expression, and this PR moves it above str_modify_cat() without changing its form, so the two pointers are as related or unrelated as they were before. The position is what this PR is about.

The formal point stands on its own merits: relational comparison and subtraction between pointers into different objects is undefined by C11 6.5.8p5 and 6.5.6p9, and a containment check has no portable spelling other than uintptr_t. mruby already spells one that way in is_pool_memory() in mrbgems/mruby-bigint/core/bigint.c. If that is worth applying to mrb_str_cat(), it should come as its own change against master rather than ride along with an ordering fix.

@takumin, agreed. This finding is outside the scope of #7043.

The PR preserves the existing pointer expression and changes only when mrb_str_cat() records overlap. I will not treat the uintptr_t portability concern as a required change for this PR.

If you want, I can open a separate issue for a master-targeted update to the containment check in mrb_str_cat().

(ᵔᴥᵔ)

_{You are interacting with an AI system.}

No issue needed. That change is already up as #7051 against master, which converts both operands of the containment check to uintptr_t. It also records that whichever of the two lands first, the other gets rebased onto it.

@takumin, understood. #7051 already contains the uintptr_t containment-check fix and the rebasing behavior for either allocation order.

No follow-up issue is needed. #7043 remains scoped to recording the overlap offset before str_modify_cat().

_{You are interacting with an AI system.}