merge revision(s) 19346c2: [Backport #19754]

	[Bug #19754] Make `IO::Buffer#get_string` check `offset` range
	 (ruby#8016)

	---
	 io_buffer.c                 | 3 +++
	 test/ruby/test_io_buffer.rb | 8 ++++++++
	 2 files changed, 11 insertions(+)

io_buffer.c

@@ -1103,8 +1103,11 @@ rb_io_buffer_free(VALUE self)
 static inline void
 io_buffer_validate_range(struct rb_io_buffer *data, size_t offset, size_t length)
 {
+    if (offset > data->size) {
+        rb_raise(rb_eArgError, "Specified offset exceeds buffer size!");
+    }
     if (offset + length > data->size) {
-        rb_raise(rb_eArgError, "Specified offset+length exceeds data size!");
+        rb_raise(rb_eArgError, "Specified offset+length exceeds buffer size!");
     }
 }
 

test/ruby/test_io_buffer.rb

@@ -237,6 +237,14 @@ def test_get_string
 
     chunk = buffer.get_string(0, message.bytesize, Encoding::BINARY)
     assert_equal Encoding::BINARY, chunk.encoding
+
+    assert_raise_with_message(ArgumentError, /exceeds buffer size/) do
+      buffer.get_string(0, 129)
+    end
+
+    assert_raise_with_message(ArgumentError, /exceeds buffer size/) do
+      buffer.get_string(129)
+    end
   end
 
   # We check that values are correctly round tripped.

version.h

@@ -11,7 +11,7 @@
 # define RUBY_VERSION_MINOR RUBY_API_VERSION_MINOR
 #define RUBY_VERSION_TEENY 2
 #define RUBY_RELEASE_DATE RUBY_RELEASE_YEAR_STR"-"RUBY_RELEASE_MONTH_STR"-"RUBY_RELEASE_DAY_STR
-#define RUBY_PATCHLEVEL 126
+#define RUBY_PATCHLEVEL 127
 
 #include "ruby/version.h"
 #include "ruby/internal/abi.h"