1berry/ruby
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Recheck array length after to_str conversion

Browse Source 
https://hackerone.com/reports/244787
This commit is contained in:
Nobuyoshi Nakada 2020-01-20 00:41:56 +09:00
parent 2b2821acd3
commit 0c436bbfbf
No known key found for this signature in database
GPG Key ID: 4BC7D6DF58D8DF60
2 changed files with 14 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
array.c
View File

@ -2374,7 +2374,9 @@ rb_ary_join(VALUE ary, VALUE sep)
if (NIL_P(tmp) || tmp != val) { if (NIL_P(tmp) || tmp != val) {
int first; int first;
result = rb_str_buf_new(len + (RARRAY_LEN(ary)-i)*10); long n = RARRAY_LEN(ary);
if (i > n) i = n;
result = rb_str_buf_new(len + (n-i)*10);
rb_enc_associate(result, rb_usascii_encoding()); rb_enc_associate(result, rb_usascii_encoding());
i = ary_join_0(ary, sep, i, result); i = ary_join_0(ary, sep, i, result);
first = i == 0; first = i == 0;

11
test/ruby/test_array.rb
View File

@ -2457,6 +2457,17 @@ class TestArray < Test::Unit::TestCase
assert_equal("ab012z", x.ary.join("")) assert_equal("ab012z", x.ary.join(""))
end end
def test_join_recheck_array_length
x = Struct.new(:ary).new
def x.to_str
ary.clear
ary[0] = "b"
"z"
end
x.ary = Array.new(1023) {"a"*1} << x
assert_equal("b", x.ary.join(""))
end
def test_to_a2 def test_to_a2
klass = Class.new(Array) klass = Class.new(Array)
a = klass.new.to_a a = klass.new.to_a