diff options
author | Nobuyoshi Nakada <nobu@ruby-lang.org> | 2020-01-20 00:29:40 +0900 |
---|---|---|
committer | Nobuyoshi Nakada <nobu@ruby-lang.org> | 2020-01-25 13:57:33 +0900 |
commit | 2b2821acd39530c6c786e34f304e9e018a31e5c4 (patch) | |
tree | 1970df5e4feb6825ac0cef77ed241231735ae043 | |
parent | 92a30acbfb0813dcf551f907791bf82954a17475 (diff) |
Recheck elements type after `to_str` conversion
https://hackerone.com/reports/244786
-rw-r--r-- | array.c | 6 | ||||
-rw-r--r-- | test/ruby/test_array.rb | 10 |
2 files changed, 14 insertions, 2 deletions
@@ -2286,7 +2286,7 @@ recursive_join(VALUE obj, VALUE argp, int recur) return Qnil; } -static void +static long ary_join_0(VALUE ary, VALUE sep, long max, VALUE result) { long i; @@ -2295,10 +2295,12 @@ ary_join_0(VALUE ary, VALUE sep, long max, VALUE result) if (max > 0) rb_enc_copy(result, RARRAY_AREF(ary, 0)); for (i=0; i<max; i++) { val = RARRAY_AREF(ary, i); + if (!RB_TYPE_P(val, T_STRING)) break; if (i > 0 && !NIL_P(sep)) rb_str_buf_append(result, sep); rb_str_buf_append(result, val); } + return i; } static void @@ -2374,7 +2376,7 @@ rb_ary_join(VALUE ary, VALUE sep) int first; result = rb_str_buf_new(len + (RARRAY_LEN(ary)-i)*10); rb_enc_associate(result, rb_usascii_encoding()); - ary_join_0(ary, sep, i, result); + i = ary_join_0(ary, sep, i, result); first = i == 0; ary_join_1(ary, ary, sep, i, result, &first); return result; diff --git a/test/ruby/test_array.rb b/test/ruby/test_array.rb index 476cf795f0..c3b842e950 100644 --- a/test/ruby/test_array.rb +++ b/test/ruby/test_array.rb @@ -2447,6 +2447,16 @@ class TestArray < Test::Unit::TestCase assert_equal("12345", [1,[2,[3,4],5]].join) end + def test_join_recheck_elements_type + x = Struct.new(:ary).new + def x.to_str + ary[2] = [0, 1, 2] + "z" + end + (x.ary = ["a", "b", "c", x]) + assert_equal("ab012z", x.ary.join("")) + end + def test_to_a2 klass = Class.new(Array) a = klass.new.to_a |