From afad9391734998df4f76a6f7108278d2aa2599a0 Mon Sep 17 00:00:00 2001
From: "Yukihiro \"Matz\" Matsumoto" <matz@ruby.or.jp>
Date: Tue, 7 Jan 2020 08:58:06 +0900
Subject: Check memory boundary in `mrb_str_len_to_dbl`.

---
 src/string.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'src/string.c')

diff --git a/src/string.c b/src/string.c
index bf11ed668..e61a85cff 100644
--- a/src/string.c
+++ b/src/string.c
@@ -2500,7 +2500,7 @@ mrb_str_len_to_dbl(mrb_state *mrb, const char *s, size_t len, mrb_bool badcheck)
   double d;
 
   if (!p) return 0.0;
-  while (ISSPACE(*p)) p++;
+  while (p<pend && ISSPACE(*p)) p++;
 
   if (pend - p > 2 && p[0] == '0' && (p[1] == 'x' || p[1] == 'X')) {
     mrb_value x;
-- 
cgit v1.2.3