string.c: guard tmp in rb_str_format_m (GH-16280)

[Bug #21931]

Keep tmp alive while RARRAY_CONST_PTR(tmp) is used by rb_str_format.

[alan: sunk the guard below usage]
Reviewed-by: Alan Wu <XrXr@users.noreply.github.com>

1 files changed, 3 insertions, 1 deletions

diff --git a/string.c b/string.c
index d5505fdb1a..500c5d3ed6 100644
--- a/string.c
+++ b/string.c
@@ -2409,7 +2409,9 @@ rb_str_format_m(VALUE str, VALUE arg)
     VALUE tmp = rb_check_array_type(arg);
 
     if (!NIL_P(tmp)) {
-        return rb_str_format(RARRAY_LENINT(tmp), RARRAY_CONST_PTR(tmp), str);
+        VALUE result = rb_str_format(RARRAY_LENINT(tmp), RARRAY_CONST_PTR(tmp), str);
+        RB_GC_GUARD(tmp);
+        return result;
     }
     return rb_str_format(1, &arg, str);
 }