AIKIDO-2026-793789

TL;DR

SmarterCSV ships a C-accelerated parser that reads CSV input in a native extension, which is the default path. When a multi-character column separator is configured, the parser performs an unbounded look-ahead while validating a closing quote and reads past the end of the line buffer for a partial separator at end-of-line, causing an out-of-bounds read that can crash the process. When the field_size_limit option is set, the C-accelerated path never enforces that limit (the check existed only on the pure-Ruby path), so an oversized digit-only field is converted into a very large integer and consumes excessive CPU and memory instead of being rejected. The fix bounds every separator comparison to the line buffer and checks the raw field size before any numeric conversion on the C path.