From df924eae91af10cc236a907cdadd97813827aa1f Mon Sep 17 00:00:00 2001
From: theyoucheng <daniel1988xyz@gmail.com>
Date: Sat, 23 May 2026 10:11:11 +0900
Subject: [PATCH] Fix undefined pointer arithmetic in UTF-8 helpers

Fixes GHSA-ggc9-rpv2-xgpm and GHSA-gvwx-xj9r-3frq.
---
 src/jv_unicode.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/src/jv_unicode.c b/src/jv_unicode.c
index 5a762315..89d90eaa 100644
--- a/src/jv_unicode.c
+++ b/src/jv_unicode.c
@@ -15,7 +15,8 @@ const char* jvp_utf8_backtrack(const char* start, const char* min, int *missing_
   }
   int length = 0;
   int seen = 1;
-  while (start >= min && (length = utf8_coding_length[(unsigned char)*start]) == UTF8_CONTINUATION_BYTE) {
+  while ((length = utf8_coding_length[(unsigned char)*start]) == UTF8_CONTINUATION_BYTE) {
+    if (start == min) break;
     start--;
     seen++;
   }
@@ -41,7 +42,7 @@ const char* jvp_utf8_next(const char* in, const char* end, int* codepoint_ret) {
   } else if (length == 0 || length == UTF8_CONTINUATION_BYTE) {
     /* Bad single byte - either an invalid byte or an out-of-place continuation byte */
     length = 1;
-  } else if (in + length > end) {
+  } else if (length > end - in) {
     /* String ends before UTF8 sequence ends */
     length = end - in;
   } else {