Check memory boundary in `mrb_str_len_to_dbl`.
@@ -2500,7 +2500,7 @@ mrb_str_len_to_dbl(mrb_state *mrb, const char *s, size_t len, mrb_bool badcheck)
double d;
if (!p) return 0.0;
- while (ISSPACE(*p)) p++;
+ while (p<pend && ISSPACE(*p)) p++;
if (pend - p > 2 && p[0] == '0' && (p[1] == 'x' || p[1] == 'X')) {
mrb_value x;
