@@ -99,7 +99,7 @@ mrb_value mrb_obj_equal_m(mrb_state *mrb, mrb_value);
 /* debug */
 size_t mrb_packed_int_len(uint32_t num);
 size_t mrb_packed_int_encode(uint32_t num, uint8_t *p);
-uint32_t mrb_packed_int_decode(const uint8_t *p, const uint8_t **newpos);
+uint32_t mrb_packed_int_decode(const uint8_t *p, const uint8_t *end, const uint8_t **newpos);
 
 
 /* codedump */
 
@@ -50,8 +50,8 @@ check_lineno(mrb_irep_debug_info_file *info_file, uint16_t lineno)
       const uint8_t *pend = p + count;
       uint32_t line = 0;
       while (p < pend) {
-        mrb_packed_int_decode(p, &p);
-        line += mrb_packed_int_decode(p, &p);
+        mrb_packed_int_decode(p, pend, &p);
+        line += mrb_packed_int_decode(p, pend, &p);
         if (line == lineno) return lineno;
       }
     }
 
@@ -77,17 +77,21 @@ mrb_packed_int_encode(uint32_t num, uint8_t *p)
  * Decodes a 32-bit unsigned integer from the variable-length packed format
  * in the byte array `p`. It reads bytes until it finds one where the most
  * significant bit is 0.
+ * If `end` is not NULL, decoding stops at `end`, so a truncated or corrupt
+ * buffer (a trailing byte whose continuation bit is set) cannot be read
+ * past; callers that decode trusted, self-produced data pass NULL.
  * If `newpos` is not NULL, it will be updated to point to the byte
  * following the last byte read.
  * Returns the decoded 32-bit unsigned integer.
  */
 uint32_t
-mrb_packed_int_decode(const uint8_t *p, const uint8_t **newpos)
+mrb_packed_int_decode(const uint8_t *p, const uint8_t *end, const uint8_t **newpos)
 {
   size_t i = 0, shift = 0;
   uint32_t n = 0;
 
   do {
+    if (end && p + i >= end) break;
     n |= ((uint32_t)(p[i] & 0x7f)) << shift;
     i++;
     shift += 7;
@@ -119,8 +123,8 @@ debug_get_line(mrb_state *mrb, mrb_irep_debug_info_file* f, uint32_t pc)
       const uint8_t *pend = p + f->line_entry_count;
       uint32_t pos = 0, line = 0;
       while (p < pend) {
-        pos += mrb_packed_int_decode(p, &p);
-        uint32_t line_diff = mrb_packed_int_decode(p, &p);
+        pos += mrb_packed_int_decode(p, pend, &p);
+        uint32_t line_diff = mrb_packed_int_decode(p, pend, &p);
         if (pc < pos) break;
         line += line_diff;
       }
 
@@ -227,7 +227,7 @@ sym_check(mrb_state *mrb, const char *name, size_t len, mrb_sym i)
   else {
     /* length in BER */
     const uint8_t *p = (const uint8_t*)symname;
-    symlen = mrb_packed_int_decode(p, &p);
+    symlen = mrb_packed_int_decode(p, NULL, &p);
     symname = (const char*)p;
   }
   if (len == symlen && memcmp(symname, name, len) == 0) {
@@ -335,7 +335,7 @@ migrate_to_hash_table(mrb_state *mrb)
     else {
       /* This is a packed length string */
       const uint8_t *p = (const uint8_t*)name;
-      len = mrb_packed_int_decode(p, &p);
+      len = mrb_packed_int_decode(p, NULL, &p);
       name = (const char*)p;
     }
 
@@ -667,7 +667,7 @@ sym2name_len(mrb_state *mrb, mrb_sym sym, char *buf, mrb_int *lenp)
 
   if (!symtbl_is_literal(tagged_ptr)) {
     const uint8_t *p = (const uint8_t*)symname;
-    uint32_t len = mrb_packed_int_decode(p, &p);
+    uint32_t len = mrb_packed_int_decode(p, NULL, &p);
     symname = (const char*)p;
     if (lenp) *lenp = (mrb_int)len;
   }
@@ -971,7 +971,7 @@ mrb_symbol_gc(mrb_state *mrb)
       }
       else {
         const uint8_t *p = (const uint8_t*)name;
-        len = mrb_packed_int_decode(p, &p);
+        len = mrb_packed_int_decode(p, NULL, &p);
         name = (const char*)p;
       }
       uint8_t hash = mrb_byte_hash((const uint8_t*)name, len);
Original file line number	Diff line number	Diff line change
`@@ -50,8 +50,8 @@ check_lineno(mrb_irep_debug_info_file *info_file, uint16_t lineno)`
`50`	`50`	`const uint8_t *pend = p + count;`
`51`	`51`	`uint32_t line = 0;`
`52`	`52`	`while (p < pend) {`
`53`		`- mrb_packed_int_decode(p, &p);`
`54`		`- line += mrb_packed_int_decode(p, &p);`
	`53`	`+ mrb_packed_int_decode(p, pend, &p);`
	`54`	`+ line += mrb_packed_int_decode(p, pend, &p);`
`55`	`55`	`if (line == lineno) return lineno;`
`56`	`56`	`}`
`57`	`57`	`}`