diff options
author | Nobuyoshi Nakada <nobu@ruby-lang.org> | 2020-01-20 00:41:56 +0900 |
---|---|---|
committer | Nobuyoshi Nakada <nobu@ruby-lang.org> | 2020-01-25 14:06:38 +0900 |
commit | 0c436bbfbf3b28fab8abfcbda9b8f388fa22290a (patch) | |
tree | 44cb3e073c7583d245404150a6790dfa4f0a7840 | |
parent | 2b2821acd39530c6c786e34f304e9e018a31e5c4 (diff) | |
download | ruby-0c436bbfbf3b28fab8abfcbda9b8f388fa22290a.tar.gz |
Recheck array length after `to_str` conversion
https://hackerone.com/reports/244787
-rw-r--r-- | array.c | 4 | ||||
-rw-r--r-- | test/ruby/test_array.rb | 11 |
2 files changed, 14 insertions, 1 deletions
@@ -2374,7 +2374,9 @@ rb_ary_join(VALUE ary, VALUE sep) if (NIL_P(tmp) || tmp != val) { int first; - result = rb_str_buf_new(len + (RARRAY_LEN(ary)-i)*10); + long n = RARRAY_LEN(ary); + if (i > n) i = n; + result = rb_str_buf_new(len + (n-i)*10); rb_enc_associate(result, rb_usascii_encoding()); i = ary_join_0(ary, sep, i, result); first = i == 0; diff --git a/test/ruby/test_array.rb b/test/ruby/test_array.rb index c3b842e950..fcfda92487 100644 --- a/test/ruby/test_array.rb +++ b/test/ruby/test_array.rb @@ -2457,6 +2457,17 @@ class TestArray < Test::Unit::TestCase assert_equal("ab012z", x.ary.join("")) end + def test_join_recheck_array_length + x = Struct.new(:ary).new + def x.to_str + ary.clear + ary[0] = "b" + "z" + end + x.ary = Array.new(1023) {"a"*1} << x + assert_equal("b", x.ary.join("")) + end + def test_to_a2 klass = Class.new(Array) a = klass.new.to_a |