From 0f50d40c23fd37d506139340fdaab6b12444f738 Mon Sep 17 00:00:00 2001
From: npt-1707 <npthanh132@gmail.com>
Date: Wed, 9 Jul 2025 01:29:02 +0800
Subject: [PATCH] Check too big code point value for single byte value in
 next_state_val()

---
 src/Onigmo/regparse.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/src/Onigmo/regparse.c b/src/Onigmo/regparse.c
index 469e8bc..7e209f5 100644
--- a/src/Onigmo/regparse.c
+++ b/src/Onigmo/regparse.c
@@ -4324,8 +4324,11 @@ next_state_val(CClassNode* cc, OnigCodePoint *vs, OnigCodePoint v,
 
   switch (*state) {
   case CCS_VALUE:
-    if (*type == CCV_SB)
+    if (*type == CCV_SB) {
+      if (*vs > 0xff)
+        return ONIGERR_INVALID_CODE_POINT_VALUE;
       BITSET_SET_BIT(cc->bs, (int )(*vs));
+    }
     else if (*type == CCV_CODE_POINT) {
       r = add_code_range(&(cc->mbuf), env, *vs, *vs);
       if (r < 0) return r;