Validate String argument in Zstd.read_skippable_frame

[Watson1978]

Summary

Zstd.read_skippable_frame called RSTRING_PTR / RSTRING_LEN on its
argument without going through StringValue(), unlike every other
public API in this gem (compress, decompress, write_skippable_frame,
streaming compress/decompress all do).

Passing a non-String therefore reinterpreted the object as an RString
and dereferenced its ptr/len fields, leading to a crash. For example a
Fixnum argument crashed at an address derived from its immediate value:

Zstd.read_skippable_frame(nil)        # SEGV
Zstd.read_skippable_frame(123456789)  # SEGV (address derived from the argument)

Fix

Add StringValue(input_value); at the top of rb_read_skippable_frame,
matching the other entry points. Non-String arguments now raise
TypeError, while String-convertible objects (#to_str) keep working.

 static VALUE rb_read_skippable_frame(VALUE self, VALUE input_value)
 {
+  StringValue(input_value);
   char* input_data = RSTRING_PTR(input_value);
   size_t input_size = RSTRING_LEN(input_value);

Tests

Added specs to spec/zstd-skippable_frame_spec.rb:

• non-String arguments (nil, Integer, Symbol, Array, Object) raise TypeError
• objects responding to #to_str are still accepted

Full suite passes (66 examples, 0 failures).

🤖 Generated with Claude Code