kotovalexarian-likes-github/ruby--ruby
1
0
Fork 0
mirror of https://github.com/ruby/ruby.git synced 2022-11-09 12:17:21 -05:00
Code Releases Activity

Recheck array length after to_str conversion

Browse source 
https://hackerone.com/reports/244787
This commit is contained in:
Nobuyoshi Nakada 2020-01-20 00:41:56 +09:00
parent 2b2821acd3
commit 0c436bbfbf
No known key found for this signature in database
GPG key ID: 4BC7D6DF58D8DF60
2 changed files with 14 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
array.c
View file

@ -2374,7 +2374,9 @@ rb_ary_join(VALUE ary, VALUE sep)
if (NIL_P(tmp) || tmp != val) {
int first;
result = rb_str_buf_new(len + (RARRAY_LEN(ary)-i)*10);
long n = RARRAY_LEN(ary);
if (i > n) i = n;
result = rb_str_buf_new(len + (n-i)*10);
rb_enc_associate(result, rb_usascii_encoding());
i = ary_join_0(ary, sep, i, result);
first = i == 0;

11
test/ruby/test_array.rb
View file

@ -2457,6 +2457,17 @@ class TestArray < Test::Unit::TestCase
assert_equal("ab012z", x.ary.join(""))
end
def test_join_recheck_array_length
x = Struct.new(:ary).new
def x.to_str
ary.clear
ary[0] = "b"
"z"
end
x.ary = Array.new(1023) {"a"*1} << x
assert_equal("b", x.ary.join(""))
end
def test_to_a2
klass = Class.new(Array)
a = klass.new.to_a