merge revision(s) bc3ac1872e4523334e3ed04c2bb70a55c4c43f98: [Backport #19748]

	[Bug #19748] Fix out-of-bound access in `String#byteindex`

	---
	 string.c                 | 17 +++++++----------
	 test/ruby/test_string.rb |  3 +++
	 2 files changed, 10 insertions(+), 10 deletions(-)

1 files changed, 7 insertions, 8 deletions

diff --git a/string.c b/string.c
index 95f023232a..b48c54adf9 100644
--- a/string.c
+++ b/string.c
@@ -4048,20 +4048,21 @@ rb_str_byteindex_m(int argc, VALUE *argv, VALUE str)
     long pos;
 
     if (rb_scan_args(argc, argv, "11", &sub, &initpos) == 2) {
+        long slen = RSTRING_LEN(str);
         pos = NUM2LONG(initpos);
-    }
-    else {
-        pos = 0;
-    }
-    if (pos < 0) {
-        pos += RSTRING_LEN(str);
         if (pos < 0) {
+            pos += slen;
+        }
+        if (pos < 0 || pos > slen) {
             if (RB_TYPE_P(sub, T_REGEXP)) {
                 rb_backref_set(Qnil);
             }
             return Qnil;
         }
     }
+    else {
+        pos = 0;
+    }
 
     if (!str_check_byte_pos(str, pos)) {
         rb_raise(rb_eIndexError,
@@ -4069,8 +4070,6 @@ rb_str_byteindex_m(int argc, VALUE *argv, VALUE str)
     }
 
     if (RB_TYPE_P(sub, T_REGEXP)) {
-        if (pos > RSTRING_LEN(str))
-            return Qnil;
         if (rb_reg_search(sub, str, pos, 0) < 0) {
             return Qnil;
         }