Fix heap buffer overflow in `unpack_a`; fix #4103

mrbgems/mruby-pack/src/pack.c

@@ -598,19 +598,21 @@ unpack_a(mrb_state *mrb, const void *src, int slen, mrb_value ary, long count, u
   }
   copylen = slen;
 
-  if (flags & PACK_FLAG_Z) {  /* "Z" */
+  if (slen >= 0 && flags & PACK_FLAG_Z) {  /* "Z" */
     if ((cp = (const char *)memchr(sptr, '\0', slen)) != NULL) {
       copylen = (int)(cp - sptr);
       if (count == -1) {
         slen = copylen + 1;
       }
     }
-  } else if (!(flags & PACK_FLAG_a)) {  /* "A" */
+  }
+  else if (!(flags & PACK_FLAG_a)) {  /* "A" */
     while (copylen > 0 && (sptr[copylen - 1] == '\0' || isspace(sptr[copylen - 1]))) {
       copylen--;
     }
   }
 
+  if (copylen < 0) copylen = 0;
   dst = mrb_str_new(mrb, sptr, (mrb_int)copylen);
   mrb_ary_push(mrb, ary, dst);
   return slen;