From c0c51502210fb8f7e7ab9a7f6c74e421178cbfa7 Mon Sep 17 00:00:00 2001
From: "William T. Nelson" <35801+wtn@users.noreply.github.com>
Date: Fri, 30 Oct 2026 23:19:52 -0500
Subject: [PATCH] Stop dropping the invalid byte 0xc1 in skip_nil and the
 header readers

HEAD_BYTE_REQUIRED, the "no head byte buffered" sentinel, was 0xc1,
the one byte MessagePack leaves undefined. A real 0xc1 in the input
therefore looked like "nothing buffered", so skip_nil, read_array_header
and read_map_header let the next call read past it and the following
read returned the next object instead of raising MalformedFormatError.
Move the sentinel to 0x100, outside the range a byte can take.

Co-authored-by: Claude Mythos 5.1 <noreply@anthropic.com>
---
 ext/msgpack/unpacker.c      |  3 ++-
 spec/cruby/unpacker_spec.rb | 28 ++++++++++++++++++++++++++++
 2 files changed, 30 insertions(+), 1 deletion(-)

diff --git a/ext/msgpack/unpacker.c b/ext/msgpack/unpacker.c
index 2178c9b1..7ee9463f 100644
--- a/ext/msgpack/unpacker.c
+++ b/ext/msgpack/unpacker.c
@@ -95,7 +95,8 @@ void msgpack_unpacker_static_destroy(void)
     msgpack_rmem_destroy(&s_stack_rmem);
 }
 
-#define HEAD_BYTE_REQUIRED 0xc1
+/* outside 0..255 so it never collides with a real byte, including the invalid 0xc1 */
+#define HEAD_BYTE_REQUIRED 0x100
 
 static inline bool _msgpack_unpacker_stack_init(msgpack_unpacker_stack_t *stack) {
     if (!stack->data) {
diff --git a/spec/cruby/unpacker_spec.rb b/spec/cruby/unpacker_spec.rb
index ae8c9b22..068e1c07 100644
--- a/spec/cruby/unpacker_spec.rb
+++ b/spec/cruby/unpacker_spec.rb
@@ -67,5 +67,33 @@
       unpacker.skip
     }.should raise_error(MessagePack::MalformedFormatError)
   end
+
+  it 'skip_nil keeps invalid byte' do
+    unpacker.feed("\xc1\x01")
+    unpacker.skip_nil.should == false
+    lambda {
+      unpacker.read
+    }.should raise_error(MessagePack::MalformedFormatError)
+  end
+
+  it 'read_array_header keeps invalid byte' do
+    unpacker.feed("\xc1\x01")
+    lambda {
+      unpacker.read_array_header
+    }.should raise_error(MessagePack::UnpackError)
+    lambda {
+      unpacker.read
+    }.should raise_error(MessagePack::MalformedFormatError)
+  end
+
+  it 'read_map_header keeps invalid byte' do
+    unpacker.feed("\xc1\x01")
+    lambda {
+      unpacker.read_map_header
+    }.should raise_error(MessagePack::UnpackError)
+    lambda {
+      unpacker.read
+    }.should raise_error(MessagePack::MalformedFormatError)
+  end
 end