Reject start_pos > end_pos in parser/lexer entrypoints

`alloc_parser_from_buffer` and `alloc_lexer_from_buffer` in the C
extension already rejected negative positions, but accepted ranges
where `start_pos > end_pos`. The lexer's main loop condition is
`current.byte_pos == end_pos`, so a reversed range never terminates:
`current` advances past `end_pos` and the equality is never satisfied,
producing an infinite loop with the GVL held (SIGINT ineffective).

Add the new guard alongside the existing negative-position check and
extract both into a `validate_position_range` helper shared by both
entrypoints.

Minimal reproducer (public API, used to hang indefinitely):

  RBS::Parser.parse_type("", byte_range: 1..0)

Found by fuzzing the parser entry points with randomized position
arguments.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: ksss

Gemfile

@@ -48,6 +48,7 @@ gem "net-smtp"
 gem 'csv'
 gem 'ostruct'
 gem 'pstore'
+gem "timeout"
 
 group :minitest do
   gem "minitest"

Gemfile.lock

@@ -231,6 +231,7 @@ DEPENDENCIES
   steep!
   tempfile
   test-unit
+  timeout
 
 BUNDLED WITH
   4.0.1

ext/rbs_extension/main.c

@@ -145,10 +145,17 @@ static VALUE parse_type_try(VALUE a) {
     return rbs_struct_to_ruby_value(ctx, type);
 }
 
-static rbs_lexer_t *alloc_lexer_from_buffer(rbs_allocator_t *allocator, VALUE string, rb_encoding *encoding, int start_pos, int end_pos) {
+static void validate_position_range(int start_pos, int end_pos) {
     if (start_pos < 0 || end_pos < 0) {
         rb_raise(rb_eArgError, "negative position range: %d...%d", start_pos, end_pos);
     }
+    if (start_pos > end_pos) {
+        rb_raise(rb_eArgError, "invalid position range: %d...%d", start_pos, end_pos);
+    }
+}
+
+static rbs_lexer_t *alloc_lexer_from_buffer(rbs_allocator_t *allocator, VALUE string, rb_encoding *encoding, int start_pos, int end_pos) {
+    validate_position_range(start_pos, end_pos);
 
     const char *encoding_name = rb_enc_name(encoding);
 
@@ -162,9 +169,7 @@ static rbs_lexer_t *alloc_lexer_from_buffer(rbs_allocator_t *allocator, VALUE st
 }
 
 static rbs_parser_t *alloc_parser_from_buffer(VALUE buffer, int start_pos, int end_pos) {
-    if (start_pos < 0 || end_pos < 0) {
-        rb_raise(rb_eArgError, "negative position range: %d...%d", start_pos, end_pos);
-    }
+    validate_position_range(start_pos, end_pos);
 
     VALUE string = rb_funcall(buffer, rb_intern("content"), 0);
     StringValue(string);

test/rbs/parser_test.rb

@@ -1,4 +1,5 @@
 require "test_helper"
+require "timeout"
 
 class RBS::ParserTest < Test::Unit::TestCase
   def buffer(source)
@@ -1028,4 +1029,23 @@ class Foo[T < Integer] < Bar # Comment
     assert_equal [:tTRIVIA, "\n", 56...57], tokens.shift.then { |t| [t[0], t[1].source, t[1].range] }
     assert_equal [:pEOF, '', 57...57], tokens.shift.then { |t| [t[0], t[1].source, t[1].range] }
   end
+
+  def test_invalid_position_range_raises
+    # Regression: start_pos > end_pos used to cause an infinite loop in the lexer.
+    Timeout.timeout(5) do
+      assert_raises(ArgumentError) do
+        RBS::Parser._parse_signature(buffer(""), 1, 0)
+      end
+    end
+  end
+
+  def test_invalid_byte_range_in_parse_type_raises
+    # Regression: parse_type's byte_range: keyword reaches _parse_type directly,
+    # which used to hang on reversed ranges.
+    Timeout.timeout(5) do
+      assert_raises(ArgumentError) do
+        RBS::Parser.parse_type("", byte_range: 1..0)
+      end
+    end
+  end
 end