Skip to content

string.c: bound check mrb_str_byte_to_char before use #7098

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
matz merged 1 commit into from
Aug 12, 2026
Merged

string.c: bound check mrb_str_byte_to_char before use #7098

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 4 additions & 2 deletions include/mruby/internal.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -174,8 +174,10 @@ uint32_t mrb_byte_hash_step(const uint8_t*, mrb_int, uint32_t);
the string ends before `nchars` characters, the remaining byte length plus
one is returned so out-of-range requests stay detectable. mrb_str_byte_to_char
returns the character index for byte offset `bi` counted from the start of
the string, or -1 when `bi` is past the end or inside a multi-byte character.
On non-UTF-8 builds a byte is a character and both are identity. */
the string, or -1 when `bi` is outside the string or inside a multi-byte
character. On non-UTF-8 builds a byte is a character, so the conversions are
identity within the string, and mrb_str_byte_to_char still rejects an offset
outside it. */
mrb_int mrb_str_char_to_byte(mrb_state *mrb, mrb_value str, mrb_int off, mrb_int nchars);
mrb_int mrb_str_byte_to_char(mrb_state *mrb, mrb_value str, mrb_int bi);

Expand Down
4 changes: 2 additions & 2 deletions src/string.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -624,6 +624,7 @@ mrb_str_byte_to_char(mrb_state *mrb, mrb_value str, mrb_int bi)
{
(void)mrb;
struct RString *s = mrb_str_ptr(str);
if (bi < 0 || RSTR_LEN(s) < bi) return -1;
if (RSTR_SINGLE_BYTE_P(s) || RSTR_BINARY_P(s)) {
return bi;
}
Expand All @@ -633,7 +634,6 @@ mrb_str_byte_to_char(mrb_state *mrb, mrb_value str, mrb_int bi)
const char *pivot = p + bi;
mrb_int i = 0;

if (e < pivot) return -1;
while (p < pivot) {
if ((*p & 0x80) == 0) {
const char *np = search_nonascii(p, pivot);
Expand Down Expand Up @@ -705,7 +705,7 @@ mrb_int
mrb_str_byte_to_char(mrb_state *mrb, mrb_value str, mrb_int bi)
{
(void)mrb;
(void)str;
if (bi < 0 || RSTRING_LEN(str) < bi) return -1;
return bi;
}
#define char_adjust(ptr, end) (ptr)
Expand Down
Loading