rubyduino 0.1.3 → 0.2.1

data/vendor/spinel/lib/regexp/re_exec.c

@@ -144,20 +144,30 @@ add_thread(pike_state *s, re_threadlist *list,
       continue;
 
     case RE_SAVE:
-      if (!s->match_only) {
+      /* Issue #779: bounds-check the slot offset against ncap so a
+         SAVE instruction emitted for a non-existent capture group
+         doesn't write past the per-thread capture row. */
+      if (!s->match_only && inst.offset < s->ncap) {
         CAP(s, cap_slot)[inst.offset] = (int)(sp - s->str);
       }
       pc++;
       continue;
 
     case RE_BOL:
-      if (sp == s->str || ((s->pat->flags & RE_FLAG_MULTILINE) && sp > s->str && sp[-1] == '\n')) {
+ /* Ruby's `^` is always line-anchored: it matches at the start of the
+    string and after any '\n', independent of the /m flag (which in
+    Ruby only makes `.` match '\n', i.e. DOTALL). `\A` (RE_BOT) is the
+    absolute-start anchor. */
+      if (sp == s->str || (sp > s->str && sp[-1] == '\n')) {
         pc++; continue;
       }
       return;
 
     case RE_EOL:
-      if (sp == s->str_end || ((s->pat->flags & RE_FLAG_MULTILINE) && *sp == '\n')) {
+ /* Ruby's `$` is always line-anchored: it matches at the end of the
+    string and before any '\n', independent of /m. `\z` (RE_EOT) /
+    `\Z` (RE_EOTNL) are the absolute-end anchors. */
+      if (sp == s->str_end || *sp == '\n') {
         pc++; continue;
       }
       return;
@@ -191,10 +201,24 @@ add_thread(pike_state *s, re_threadlist *list,
       return;
 
     case RE_MATCH:
-      s->matched = TRUE;
+      /* Issue #909: pick the best match per Ruby semantics — earliest
+         start position wins; within the same start, longest length
+         (greedy) wins. The previous "last MATCH overwrites" rule got
+         greedy quantifiers right (`\w+` correctly extended the
+         match) but let a later-starting thread (like `\w\w`'s second
+         thread starting one byte later) clobber an earlier-starting
+         match's captures. */
       if (s->result_caps) {
-        memcpy(s->result_caps, CAP(s, cap_slot), sizeof(int) * s->ncap);
+        int *cap = CAP(s, cap_slot);
+        int new_start = cap[0], new_end = cap[1];
+        int cur_start = s->result_caps[0], cur_end = s->result_caps[1];
+        if (s->matched) {
+          if (new_start > cur_start) return;
+          if (new_start == cur_start && new_end <= cur_end) return;
+        }
+        memcpy(s->result_caps, cap, sizeof(int) * s->ncap);
       }
+      s->matched = TRUE;
       return;
 
     default:
@@ -203,12 +227,21 @@ add_thread(pike_state *s, re_threadlist *list,
     break;
   }
 
-  if (list->count < list->capa) {
-    re_thread *t = &list->threads[list->count++];
-    t->pc = pc;
-    t->cap_slot = cap_slot;
-    t->sp = sp;
+  /* Issue #756: grow the thread list on demand instead of silently
+     dropping the new thread. The previous form produced false
+     negatives on patterns with many simultaneous alternatives. */
+  if (list->count >= list->capa) {
+    int new_capa = list->capa * 2;
+    re_thread *nt = (re_thread *)realloc(list->threads,
+                                         sizeof(re_thread) * new_capa);
+    if (!nt) return;  /* OOM: drop the thread, same as before */
+    list->threads = nt;
+    list->capa = new_capa;
   }
+  re_thread *t = &list->threads[list->count++];
+  t->pc = pc;
+  t->cap_slot = cap_slot;
+  t->sp = sp;
 }
 
 static int
@@ -418,9 +451,27 @@ pike_vm(const mrb_regexp_pattern *pat,
  * Step-limited to prevent ReDoS.
  */
 static mrb_bool
+bt_match_depth(const mrb_regexp_pattern *pat, const char *str, const char *str_end,
+               const char *sp, uint32_t pc, int *captures, int ncap, int *steps,
+               int depth);
+
+static mrb_bool
 bt_match(const mrb_regexp_pattern *pat, const char *str, const char *str_end,
          const char *sp, uint32_t pc, int *captures, int ncap, int *steps)
 {
+  return bt_match_depth(pat, str, str_end, sp, pc, captures, ncap, steps, 0);
+}
+
+static mrb_bool
+bt_match_depth(const mrb_regexp_pattern *pat, const char *str, const char *str_end,
+               const char *sp, uint32_t pc, int *captures, int ncap, int *steps,
+               int depth)
+{
+  /* Issue #777: bail before driving the C stack to overflow. The
+     callers below recurse on SPLIT / SAVE / lookahead / lookbehind;
+     each level adds one C frame. Treat over-deep as a failed match
+     -- conservative, in line with how steps-limit is handled. */
+  if (depth > MRB_REGEXP_DEPTH_LIMIT) return FALSE;
   while (pc < pat->code_len) {
     if (++(*steps) > MRB_REGEXP_STEP_LIMIT) return FALSE;
 
@@ -471,12 +522,12 @@ bt_match(const mrb_regexp_pattern *pat, const char *str, const char *str_end,
       break;
 
     case RE_SPLIT:
-      if (bt_match(pat, str, str_end, sp, pc + 1, captures, ncap, steps)) return TRUE;
+      if (bt_match_depth(pat, str, str_end, sp, pc + 1, captures, ncap, steps, depth + 1)) return TRUE;
       pc = inst.offset;
       break;
 
     case RE_SPLITNG:
-      if (bt_match(pat, str, str_end, sp, inst.offset, captures, ncap, steps)) return TRUE;
+      if (bt_match_depth(pat, str, str_end, sp, inst.offset, captures, ncap, steps, depth + 1)) return TRUE;
       pc++;
       break;
 
@@ -486,19 +537,23 @@ bt_match(const mrb_regexp_pattern *pat, const char *str, const char *str_end,
         if (slot < ncap) {
           int old = captures[slot];
           captures[slot] = (int)(sp - str);
-          if (bt_match(pat, str, str_end, sp, pc + 1, captures, ncap, steps)) return TRUE;
+          if (bt_match_depth(pat, str, str_end, sp, pc + 1, captures, ncap, steps, depth + 1)) return TRUE;
           captures[slot] = old;
         }
         return FALSE;
       }
 
     case RE_BOL:
-      if (sp != str && !(pat->flags & RE_FLAG_MULTILINE && sp > str && sp[-1] == '\n')) return FALSE;
+ /* Ruby `^`: always line-anchored (start of string or after '\n'),
+    independent of /m. See the RE_BOL note in the NFA loop above. */
+      if (sp != str && !(sp > str && sp[-1] == '\n')) return FALSE;
       pc++;
       break;
 
     case RE_EOL:
-      if (sp != str_end && !(pat->flags & RE_FLAG_MULTILINE && *sp == '\n')) return FALSE;
+ /* Ruby `$`: always line-anchored (end of string or before '\n'),
+    independent of /m. */
+      if (sp != str_end && *sp != '\n') return FALSE;
       pc++;
       break;
 
@@ -533,6 +588,12 @@ bt_match(const mrb_regexp_pattern *pat, const char *str, const char *str_end,
     case RE_BACKREF:
       {
         int group = inst.a;
+        /* Issue #753: bounds-check the group index against the
+           captures array. A backref to a non-existent group (e.g.
+           `/(\\1)/`) would read past captures[] and use garbage as
+           the start/end. CRuby returns nil (no match) -- match the
+           same by returning FALSE without dereferencing. */
+        if (group * 2 + 1 >= ncap) return FALSE;
         int gs = captures[group * 2];
         int ge = captures[group * 2 + 1];
         if (gs < 0 || ge < 0) return FALSE;
@@ -545,13 +606,13 @@ bt_match(const mrb_regexp_pattern *pat, const char *str, const char *str_end,
       break;
 
     case RE_LOOKAHEAD:
-      if (!bt_match(pat, str, str_end, sp, pc + 1, captures, ncap, steps))
+      if (!bt_match_depth(pat, str, str_end, sp, pc + 1, captures, ncap, steps, depth + 1))
         return FALSE;
       pc = inst.offset;
       break;
 
     case RE_NEG_LOOKAHEAD:
-      if (bt_match(pat, str, str_end, sp, pc + 1, captures, ncap, steps))
+      if (bt_match_depth(pat, str, str_end, sp, pc + 1, captures, ncap, steps, depth + 1))
         return FALSE;
       pc = inst.offset;
       break;
@@ -560,7 +621,7 @@ bt_match(const mrb_regexp_pattern *pat, const char *str, const char *str_end,
       {
         int lb_len = inst.a;
         if (sp - str < lb_len) return FALSE;  /* not enough text before */
-        if (!bt_match(pat, str, str_end, sp - lb_len, pc + 1, captures, ncap, steps))
+        if (!bt_match_depth(pat, str, str_end, sp - lb_len, pc + 1, captures, ncap, steps, depth + 1))
           return FALSE;
         pc = inst.offset;
       }
@@ -570,7 +631,7 @@ bt_match(const mrb_regexp_pattern *pat, const char *str, const char *str_end,
       {
         int lb_len = inst.a;
         if (sp - str >= lb_len) {
-          if (bt_match(pat, str, str_end, sp - lb_len, pc + 1, captures, ncap, steps))
+          if (bt_match_depth(pat, str, str_end, sp - lb_len, pc + 1, captures, ncap, steps, depth + 1))
             return FALSE;
         }
         /* if not enough text before, negative lookbehind succeeds */

data/vendor/spinel/lib/regexp/re_internal.h

@@ -109,8 +109,22 @@ typedef struct mrb_regexp_pattern {
 #define MRB_REGEXP_STEP_LIMIT 1000000
 #endif
 
-/* Maximum captures */
-#define RE_MAX_CAPTURES 32
+/* Recursion depth ceiling for bt_match. Backtracking SPLIT/SAVE
+   recursion can otherwise drive the C stack to overflow on patterns
+   like long alternation chains or backref + many quantifier
+   iterations. 10000 frames covers realistic workloads while staying
+   well under a default 8 MB stack (~40 bytes per frame). Issue #777. */
+#ifndef MRB_REGEXP_DEPTH_LIMIT
+#define MRB_REGEXP_DEPTH_LIMIT 10000
+#endif
+
+/* Maximum captures. Sized for realistic code: complex parsers rarely
+   exceed ~50-100 capture groups. Pathological inputs like depth-500
+   `((((...((a))...))))` raise RegexpError, which is the same
+   "fail-gracefully on absurd input" stance as MRB_REGEXP_DEPTH_LIMIT
+   above. Runtime memory scales with actual ncap per regex (see
+   re_exec.c comment) so this is purely a compile-time cap. */
+#define RE_MAX_CAPTURES 128
 
 /* Thread struct for Pike VM. `sp` is the input position the thread is
    waiting for; the outer loop only dispatches a thread when its sp
@@ -131,6 +145,12 @@ mrb_regexp_pattern* re_compile(const char *pattern, mrb_int len, uint32_t flags)
 /* Free a compiled pattern */
 void re_free(mrb_regexp_pattern *pat);
 
+/* Issue #781: install a callback that handles regex compile errors.
+   The callback receives a formatted message and is expected NOT to
+   return (typically it wraps sp_raise_cls via longjmp). Unset by
+   default; the library falls back to fprintf + exit. */
+void sp_re_set_error_handler(void (*fn)(const char *msg));
+
 /* Execute a match.
    Returns number of captures filled (0 = no match).
    captures[2*n] = start, captures[2*n+1] = end for group n. */

data/vendor/spinel/lib/regexp/re_utf8.c

@@ -26,7 +26,11 @@ re_utf8_charlen(const char *s, const char *end)
 }
 
 /* Decode a UTF-8 character and return its codepoint.
-   *len is set to the byte length consumed. */
+   *len is set to the byte length consumed.
+   Issue #780: reject overlong sequences (where a multi-byte form
+   encodes a codepoint that fits in fewer bytes). RFC 3629 + Ruby
+   both treat these as invalid. Returns U+FFFD (replacement) and
+   consumes just the lead byte so the caller can resync. */
 uint32_t
 re_utf8_decode(const char *s, int *len)
 {
@@ -39,27 +43,42 @@ re_utf8_decode(const char *s, int *len)
   }
   else if (c < 0xc0) {
     *len = 1;
-    return c;  /* invalid, return as-is */
+    return c;  /* invalid lead byte, return as-is */
   }
   else if (c < 0xe0) {
+    /* Issue #754: validate continuation byte before reading further.
+       NUL (0x00) is the C string terminator -- a 2-byte lead at
+       end-of-string would otherwise pull garbage. Also rejects any
+       byte without the 10xxxxxx continuation pattern. */
+    if (((uint8_t)s[1] & 0xc0) != 0x80) { *len = 1; return 0xFFFD; }
     *len = 2;
     cp = (c & 0x1f) << 6;
     cp |= ((uint8_t)s[1] & 0x3f);
+    if (cp < 0x80) { *len = 1; return 0xFFFD; }
     return cp;
   }
   else if (c < 0xf0) {
+    if (((uint8_t)s[1] & 0xc0) != 0x80 || ((uint8_t)s[2] & 0xc0) != 0x80) {
+      *len = 1; return 0xFFFD;
+    }
     *len = 3;
     cp = (c & 0x0f) << 12;
     cp |= ((uint8_t)s[1] & 0x3f) << 6;
     cp |= ((uint8_t)s[2] & 0x3f);
+    if (cp < 0x800) { *len = 1; return 0xFFFD; }
     return cp;
   }
   else {
+    if (((uint8_t)s[1] & 0xc0) != 0x80 || ((uint8_t)s[2] & 0xc0) != 0x80 ||
+        ((uint8_t)s[3] & 0xc0) != 0x80) {
+      *len = 1; return 0xFFFD;
+    }
     *len = 4;
     cp = (c & 0x07) << 18;
     cp |= ((uint8_t)s[1] & 0x3f) << 12;
     cp |= ((uint8_t)s[2] & 0x3f) << 6;
     cp |= ((uint8_t)s[3] & 0x3f);
+    if (cp < 0x10000 || cp > 0x10FFFF) { *len = 1; return 0xFFFD; }
     return cp;
   }
 }

data/vendor/spinel/lib/sp_bigint.c

@@ -14,6 +14,10 @@
 #include <string.h>
 #include "sp_bigint.h"
 
+/* Defined in sp_runtime.h (linked into the final program); forward-declared
+   here so the bigint object can raise without pulling in the whole header. */
+extern void sp_raise_cls(const char *cls, const char *msg);
+
 #define DIG_SIZE (MPZ_DIG_SIZE)
 #define DIG_BASE (1ULL << DIG_SIZE)
 #define DIG_MASK (DIG_BASE - 1)
@@ -5352,6 +5356,9 @@ sp_Bigint *sp_bigint_mod(sp_Bigint *a, sp_Bigint *b) {
 }
 
 sp_Bigint *sp_bigint_pow(sp_Bigint *base, int64_t exp) {
+  /* No Rational: a negative integer exponent raises RangeError rather than
+     truncating to 0 (mirrors sp_int_pow). See docs/INCOMPATIBILITIES.md. */
+  if (exp < 0) sp_raise_cls("RangeError", "negative exponent");
   sp_Bigint *r = sp_bigint_alloc();
   mpz_init(sp_mpz_ctx, &r->mpz);
   mpz_pow(sp_mpz_ctx, &r->mpz, &base->mpz, exp);
@@ -5363,7 +5370,12 @@ int sp_bigint_cmp(sp_Bigint *a, sp_Bigint *b) {
 }
 
 int64_t sp_bigint_to_int(sp_Bigint *b) {
-  /* Extract int64 from mpz - for small values */
+  /* Extract int64 from mpz - for small values.
+     Treat NULL as 0 -- a promote-mode method body whose tail is a
+     setter / void-shape statement returns NULL (the bigint default),
+     and the caller may unwrap with sp_bigint_to_int when its slot
+     wants mrb_int. */
+  if (b == NULL) return 0;
   mpz_t *z = &b->mpz;
   if (z->sz == 0) return 0;
   int64_t v = 0;
@@ -5374,11 +5386,63 @@ int64_t sp_bigint_to_int(sp_Bigint *b) {
   return z->sn < 0 ? -v : v;
 }
 
+/* Bitwise ops on bigint (Phase 1 of --int-overflow=promote
+   coverage). Implemented via int64 round-trip: every bigint
+   produced by promotion in spinel is derived from a small int
+   that fits in int64, so the round-trip preserves Ruby semantics
+   for any value in [INT64_MIN, INT64_MAX]. Values exceeding that
+   range lose precision; that's acceptable as a starting point
+   (extremely rare in practice -- bitops on integers > 2^63
+   aren't a real workload yet). A future commit can swap in the
+   custom mpz_and / mpz_ior / mpz_xor / mpz_com implementations
+   if the int64 path proves insufficient. */
+sp_Bigint *sp_bigint_and(sp_Bigint *a, sp_Bigint *b) {
+  return sp_bigint_new_int(sp_bigint_to_int(a) & sp_bigint_to_int(b));
+}
+
+sp_Bigint *sp_bigint_or(sp_Bigint *a, sp_Bigint *b) {
+  return sp_bigint_new_int(sp_bigint_to_int(a) | sp_bigint_to_int(b));
+}
+
+sp_Bigint *sp_bigint_xor(sp_Bigint *a, sp_Bigint *b) {
+  return sp_bigint_new_int(sp_bigint_to_int(a) ^ sp_bigint_to_int(b));
+}
+
+sp_Bigint *sp_bigint_shr(sp_Bigint *a, int64_t n);  /* forward decl for mutual recursion */
+
+sp_Bigint *sp_bigint_shl(sp_Bigint *a, int64_t n) {
+  if (n < 0) return sp_bigint_shr(a, -n);
+  if (n >= 64) return sp_bigint_new_int(0);
+  return sp_bigint_new_int(sp_bigint_to_int(a) << n);
+}
+
+sp_Bigint *sp_bigint_shr(sp_Bigint *a, int64_t n) {
+  if (n < 0) return sp_bigint_shl(a, -n);
+  if (n >= 64) {
+    /* arithmetic right shift: negative -> -1, positive -> 0 */
+    return sp_bigint_new_int(sp_bigint_to_int(a) < 0 ? -1 : 0);
+  }
+  return sp_bigint_new_int(sp_bigint_to_int(a) >> n);
+}
+
+sp_Bigint *sp_bigint_not(sp_Bigint *a) {
+  return sp_bigint_new_int(~sp_bigint_to_int(a));
+}
+
 const char *sp_bigint_to_s(sp_Bigint *b) {
+  if (!b) return "0";   /* defensive: NULL bigint surfaces as "0" rather than segfault */
   sp_bigint_init_ctx();
   mpz_t *z = &b->mpz;
-  /* Small number fast path */
-  if (z->sz <= 2) {
+  /* Small number fast path. Two limbs (DIG_SIZE=32) hold up to 64
+     unsigned bits, so the int64 cast can wrap for magnitudes in
+     [INT64_MAX+1, UINT64_MAX]. Skip the fast path when the high
+     limb's top bit is set -- that value can't round-trip through
+     sp_bigint_to_int's int64 reassembly. Fall through to mpz_get_str
+     instead. (Before this guard, `1e19 = 10_000_000_000_000_000_000`
+     printed as `-8446744073709551616` -- the wrap of 1e19 mod 2^64
+     reinterpreted as signed int64. Surface for promote-mode runs
+     past 2^63.) */
+  if (z->sz <= 1 || (z->sz == 2 && (z->p[1] >> (DIG_SIZE - 1)) == 0)) {
     int64_t v = sp_bigint_to_int(b);
     char *s = (char*)malloc(24);
     snprintf(s, 24, "%lld", (long long)v);

data/vendor/spinel/lib/sp_core.c

@@ -0,0 +1,248 @@
+/* sp_core.c -- runtime helpers split out of sp_runtime.h into
+ * libspinel_rt.a. See sp_core.h for the rationale. */
+#include "sp_core.h"
+#include <stdlib.h>
+#include <ctype.h>
+#include <errno.h>
+
+/* Must match sp_types.h: mrb_int is pointer-width (int64 on 64-bit,
+   int32 on 32-bit) so this TU's helper ABI agrees with the generated TU. */
+typedef intptr_t mrb_int;
+typedef double  mrb_float;
+/* 10^p fits mrb_int only up to this exponent (p>= it collapses to 0):
+   10^19 > INT64_MAX, 10^10 > INT32_MAX. */
+#if INTPTR_MAX == INT32_MAX
+#define SP_INT_POW10_LIMIT 10
+#else
+#define SP_INT_POW10_LIMIT 19
+#endif
+
+/* Defined in the generated translation unit (sp_runtime.h); referenced
+   here and resolved at link time. */
+void sp_raise_cls(const char *cls, const char *msg);
+const char *sp_sprintf(const char *fmt, ...);
+
+/* CRuby's `String#to_i` accepts a leading sign, then digits with
+   `_` between consecutive digits, and stops at the first non-digit
+   (returning what it has so far rather than raising). `"1_2_3asdf"`
+   -> 123. spinel previously emitted `(mrb_int)atoll(s)` which stops
+   at the first `_`, returning 1 instead. Issue #619. */
+mrb_int sp_str_to_i_cruby(const char *s) {
+  if (!s) return 0;
+  const char *p = s;
+  while (isspace((unsigned char)*p)) p++;
+  int neg = 0;
+  if (*p == '+') p++;
+  else if (*p == '-') { neg = 1; p++; }
+  mrb_int v = 0;
+  int any = 0;
+  while (*p) {
+    if (*p >= '0' && *p <= '9') {
+      /* Signed-overflow on `v * 10 + digit` is undefined behavior;
+         detect via __builtin_*_overflow. CRuby promotes to Bignum
+         on overflow but spinel's int model is int64-only -- raise
+         RangeError instead of silently saturating, so a user-side
+         `rescue` can react. */
+      mrb_int t;
+      if (__builtin_mul_overflow(v, 10, &t) ||
+          __builtin_add_overflow(t, (mrb_int)(*p - '0'), &v)) {
+        sp_raise_cls("RangeError", sp_sprintf("integer overflow parsing \"%s\"", s));
+      }
+      any = 1;
+      p++;
+    } else if (*p == '_' && any && p[1] >= '0' && p[1] <= '9') {
+      p++;
+    } else {
+      break;
+    }
+  }
+  if (!any) return 0;
+  return neg ? -v : v;
+}
+
+/* `String#to_i(base)` with a non-decimal base. Accepts bases 2..36
+   like MRI; `_` is allowed between digits the same way as base 10.
+   Stops at the first invalid digit and returns what's parsed so
+   far. Issue #883. */
+mrb_int sp_str_to_i_base(const char *s, mrb_int base) {
+  if (!s) return 0;
+  /* base 0 = auto-detect from prefix (0x -> 16, 0b -> 2, 0/0o -> 8,
+     otherwise 10). Per CRuby, only base 0 enables prefix-based
+     dispatch -- explicit bases just *accept* the matching prefix. */
+  if (base != 0 && (base < 2 || base > 36)) base = 10;
+  const char *p = s;
+  while (isspace((unsigned char)*p)) p++;
+  int neg = 0;
+  if (*p == '+') p++;
+  else if (*p == '-') { neg = 1; p++; }
+  if (base == 0) {
+    if (*p == '0') {
+      if (p[1] == 'x' || p[1] == 'X') { base = 16; p += 2; }
+      else if (p[1] == 'b' || p[1] == 'B') { base = 2; p += 2; }
+      else if (p[1] == 'o' || p[1] == 'O') { base = 8; p += 2; }
+      else if (p[1] == 'd' || p[1] == 'D') { base = 10; p += 2; }
+      else if (p[1] >= '0' && p[1] <= '7') { base = 8; p++; }
+      else { base = 10; }
+    } else {
+      base = 10;
+    }
+  } else if (*p == '0' && p[1] != 0) {
+    /* Explicit base accepts the matching prefix. */
+    if ((base == 16) && (p[1] == 'x' || p[1] == 'X')) p += 2;
+    else if ((base == 2) && (p[1] == 'b' || p[1] == 'B')) p += 2;
+    else if ((base == 8) && (p[1] == 'o' || p[1] == 'O')) p += 2;
+  }
+  mrb_int v = 0;
+  int any = 0;
+  while (*p) {
+    int d = -1;
+    if (*p >= '0' && *p <= '9') d = *p - '0';
+    else if (*p >= 'a' && *p <= 'z') d = *p - 'a' + 10;
+    else if (*p >= 'A' && *p <= 'Z') d = *p - 'A' + 10;
+    if (d < 0 || d >= (int)base) {
+      if (*p == '_' && any) {
+        /* Lookahead: only consume `_` between digits. */
+        int n = -1;
+        char c = p[1];
+        if (c >= '0' && c <= '9') n = c - '0';
+        else if (c >= 'a' && c <= 'z') n = c - 'a' + 10;
+        else if (c >= 'A' && c <= 'Z') n = c - 'A' + 10;
+        if (n >= 0 && n < (int)base) { p++; continue; }
+      }
+      break;
+    }
+    mrb_int t;
+    if (__builtin_mul_overflow(v, base, &t) ||
+        __builtin_add_overflow(t, (mrb_int)d, &v)) {
+      sp_raise_cls("RangeError", sp_sprintf("integer overflow parsing \"%s\"", s));
+    }
+    any = 1;
+    p++;
+  }
+  if (!any) return 0;
+  return neg ? -v : v;
+}
+
+/* CRuby's `Integer(s)` raises ArgumentError for unparseable input
+   (empty string, leading/trailing junk, all-whitespace). The bare
+   `(mrb_int)strtoll(s, NULL, 10)` spinel previously emitted silently
+   returned 0 instead, which made `Integer(s) rescue 0` always take
+   the main branch. This helper matches CRuby semantics: skips
+   leading/trailing whitespace, requires at least one valid digit,
+   rejects trailing junk. Accepts an optional leading `+` / `-`. */
+mrb_int sp_str_to_i_strict(const char *s) {
+  if (!s) sp_raise_cls("ArgumentError", "invalid value for Integer(): nil");
+  const char *p = s;
+  while (isspace((unsigned char)*p)) p++;
+  if (*p == '\0') sp_raise_cls("ArgumentError", sp_sprintf("invalid value for Integer(): \"%s\"", s));
+  char *endptr;
+  errno = 0;
+  long long v = strtoll(p, &endptr, 10);
+  if (endptr == p) sp_raise_cls("ArgumentError", sp_sprintf("invalid value for Integer(): \"%s\"", s));
+  /* strtoll signals overflow via errno=ERANGE and clamps to
+     LLONG_MAX/MIN -- raise rather than silently saturate so the
+     caller can distinguish "fits in int64" from "too big". */
+  if (errno == ERANGE) sp_raise_cls("RangeError", sp_sprintf("integer overflow parsing \"%s\"", s));
+  while (isspace((unsigned char)*endptr)) endptr++;
+  if (*endptr != '\0') sp_raise_cls("ArgumentError", sp_sprintf("invalid value for Integer(): \"%s\"", s));
+  /* On 32-bit mrb_int, a value that fit int64 (strtoll) may not fit the
+     Ruby Integer; raise rather than silently truncate. No-op on 64-bit. */
+#if INTPTR_MAX != INT64_MAX
+  if (v < (long long)INTPTR_MIN || v > (long long)INTPTR_MAX)
+    sp_raise_cls("RangeError", sp_sprintf("integer %lld out of range for 32-bit Integer", v));
+#endif
+  return (mrb_int)v;
+}
+
+/* `Integer(s, base)` with explicit base. Bases 2..36, MRI-compatible
+   prefix recognition (0x / 0b / 0o when the base matches). Raises
+   ArgumentError on invalid input or unsupported base. Issue #887. */
+mrb_int sp_str_to_i_strict_base(const char *s, mrb_int base) {
+  if (!s) sp_raise_cls("ArgumentError", "invalid value for Integer(): nil");
+  if (base < 2 || base > 36) sp_raise_cls("ArgumentError", sp_sprintf("invalid radix %lld", (long long)base));
+  const char *p = s;
+  while (isspace((unsigned char)*p)) p++;
+  int neg = 0;
+  if (*p == '+') p++;
+  else if (*p == '-') { neg = 1; p++; }
+  if (*p == '0' && p[1] != 0) {
+    if ((base == 16) && (p[1] == 'x' || p[1] == 'X')) p += 2;
+    else if ((base == 2) && (p[1] == 'b' || p[1] == 'B')) p += 2;
+    else if ((base == 8) && (p[1] == 'o' || p[1] == 'O')) p += 2;
+  }
+  if (*p == '\0') sp_raise_cls("ArgumentError", sp_sprintf("invalid value for Integer(): \"%s\"", s));
+  mrb_int v = 0;
+  int any = 0;
+  while (*p) {
+    int d = -1;
+    if (*p >= '0' && *p <= '9') d = *p - '0';
+    else if (*p >= 'a' && *p <= 'z') d = *p - 'a' + 10;
+    else if (*p >= 'A' && *p <= 'Z') d = *p - 'A' + 10;
+    if (d < 0 || d >= (int)base) {
+      if (*p == '_' && any) {
+        int n = -1;
+        char c = p[1];
+        if (c >= '0' && c <= '9') n = c - '0';
+        else if (c >= 'a' && c <= 'z') n = c - 'a' + 10;
+        else if (c >= 'A' && c <= 'Z') n = c - 'A' + 10;
+        if (n >= 0 && n < (int)base) { p++; continue; }
+      }
+      break;
+    }
+    {
+      mrb_int t;
+      if (__builtin_mul_overflow(v, base, &t) ||
+          __builtin_add_overflow(t, (mrb_int)d, &v)) {
+        sp_raise_cls("RangeError", sp_sprintf("integer overflow parsing \"%s\"", s));
+      }
+    }
+    any = 1;
+    p++;
+  }
+  if (!any) sp_raise_cls("ArgumentError", sp_sprintf("invalid value for Integer(): \"%s\"", s));
+  while (isspace((unsigned char)*p)) p++;
+  if (*p != '\0') sp_raise_cls("ArgumentError", sp_sprintf("invalid value for Integer(): \"%s\"", s));
+  return neg ? -v : v;
+}
+
+/* Kernel#Float() raises ArgumentError on unparseable input. strtod
+   on its own would silently return 0.0 for "abc" or empty input;
+   match MRI semantics by validating at-least-one-digit + no-trailing-
+   junk. Whitespace flanking is fine. Issue #888. */
+mrb_float sp_str_to_f_strict(const char *s) {
+  if (!s) sp_raise_cls("ArgumentError", "invalid value for Float(): nil");
+  const char *p = s;
+  while (isspace((unsigned char)*p)) p++;
+  if (*p == '\0') sp_raise_cls("ArgumentError", sp_sprintf("invalid value for Float(): \"%s\"", s));
+  char *endptr;
+  double v = strtod(p, &endptr);
+  if (endptr == p) sp_raise_cls("ArgumentError", sp_sprintf("invalid value for Float(): \"%s\"", s));
+  while (isspace((unsigned char)*endptr)) endptr++;
+  if (*endptr != '\0') sp_raise_cls("ArgumentError", sp_sprintf("invalid value for Float(): \"%s\"", s));
+  return (mrb_float)v;
+}
+
+/* Cold integer-math and String#oct helpers, moved out of sp_runtime.h
+ * so they're compiled once into libspinel_rt.a rather than re-parsed
+ * in every generated translation unit. Leaf functions: arithmetic +
+ * libc + sp_raise_cls only. */
+mrb_int sp_gcd(mrb_int a,mrb_int b){if(a<0)a=-a;if(b<0)b=-b;while(b){mrb_int t=b;b=a%b;a=t;}return a;}
+mrb_int sp_lcm(mrb_int a,mrb_int b){if(a==0||b==0)return 0;mrb_int g=sp_gcd(a,b);if(a<0)a=-a;if(b<0)b=-b;return (a/g)*b;}
+mrb_int sp_powmod(mrb_int base,mrb_int exp,mrb_int mod){if(mod==0)sp_raise_cls("ZeroDivisionError","divided by 0");mrb_int r=1;mrb_int m=mod<0?-mod:mod;if(m==1){r=0;}else{base=base%m;if(base<0)base+=m;while(exp>0){if(exp%2==1)r=r*base%m;exp=exp/2;base=base*base%m;}}if(mod<0&&r>0)r-=m;return r;}
+mrb_int sp_ceildiv(mrb_int a,mrb_int b){if(b==0)sp_raise_cls("ZeroDivisionError","divided by 0");if(b==-1)return -a;mrb_int q=a/b;if(a%b!=0&&((a^b)>=0))q++;return q;}
+mrb_int sp_int_clamp(mrb_int v,mrb_int lo,mrb_int hi){return v<lo?lo:v>hi?hi:v;}
+/* Integer square root via Newton's method -- exact for the full
+   mrb_int range. Negative input returns 0 (no exception path). */
+mrb_int sp_int_sqrt(mrb_int n){if(n<0)return 0;if(n<2)return n;mrb_int x=n,y=(x+1)/2;while(y<x){x=y;y=(x+n/x)/2;}return x;}
+/* Integer#round/ceil/floor/truncate at 10^(-ndigits). Pure integer
+   arithmetic (no double precision loss above 2^53). 10^p fits mrb_int
+   only for p<=18; p>=19 collapses to 0. Round-up multiply is overflow-
+   guarded and falls back to the truncated value. */
+mrb_int sp_ipow10(mrb_int p){mrb_int f=1;mrb_int i=0;while(i<p){f*=10;i++;}return f;}
+mrb_int sp_int_round(mrb_int v,mrb_int nd){if(nd>=0)return v;mrb_int p=-nd;if(p>=SP_INT_POW10_LIMIT)return 0;mrb_int f=sp_ipow10(p);mrb_int q=v/f,r=v%f,half=f/2;if(v>=0){if(r>=half&&q<INTPTR_MAX/f)return(q+1)*f;return q*f;}if(-r>=half&&q>INTPTR_MIN/f)return(q-1)*f;return q*f;}
+mrb_int sp_int_ceil(mrb_int v,mrb_int nd){if(nd>=0)return v;mrb_int p=-nd;if(p>=SP_INT_POW10_LIMIT)return 0;mrb_int f=sp_ipow10(p);mrb_int q=v/f,r=v%f;if(r!=0&&v>0&&q<INTPTR_MAX/f)return(q+1)*f;return q*f;}
+mrb_int sp_int_floor(mrb_int v,mrb_int nd){if(nd>=0)return v;mrb_int p=-nd;if(p>=SP_INT_POW10_LIMIT)return 0;mrb_int f=sp_ipow10(p);mrb_int q=v/f,r=v%f;if(r!=0&&v<0&&q>INTPTR_MIN/f)return(q-1)*f;return q*f;}
+mrb_int sp_int_truncate(mrb_int v,mrb_int nd){if(nd>=0)return v;mrb_int p=-nd;if(p>=SP_INT_POW10_LIMIT)return 0;mrb_int f=sp_ipow10(p);return(v/f)*f;}
+/* String#oct: prefix auto-detection (0x=hex, 0b=bin, 0o/0=oct, else
+   base-8). Matches CRuby. */
+mrb_int sp_str_oct(const char*s){if(!s)return 0;const char*p=s;while(*p==' '||*p=='\t')p++;if(p[0]=='0'){if(p[1]=='x'||p[1]=='X')return(mrb_int)strtoll(p,NULL,16);if(p[1]=='b'||p[1]=='B')return(mrb_int)strtoll(p+2,NULL,2);if(p[1]=='o'||p[1]=='O')return(mrb_int)strtoll(p+2,NULL,8);return(mrb_int)strtoll(p,NULL,8);}return(mrb_int)strtoll(p,NULL,8);}