Fix heap buffer overflow; ref #4549

This patch is showed in #4549.

1 files changed, 5 insertions, 1 deletions

diff --git a/src/string.c b/src/string.c
index 6938418fb..7a094b3a7 100644
--- a/src/string.c
+++ b/src/string.c
@@ -1184,7 +1184,7 @@ str_replace_partial(mrb_state *mrb, mrb_value src, mrb_int pos, mrb_int end, mrb
 
   mrb_str_modify(mrb, str);
 
-  if (len < newlen || len - newlen >= shrink_threshold) {
+  if (len < newlen) {
     resize_capa(mrb, str, newlen);
   }
 
@@ -1197,6 +1197,10 @@ str_replace_partial(mrb_state *mrb, mrb_value src, mrb_int pos, mrb_int end, mrb
   RSTR_SET_LEN(str, newlen);
   strp[newlen] = '\0';
 
+  if (len - newlen >= shrink_threshold) {
+    resize_capa(mrb, str, newlen);
+  }
+
   return src;
 }