diff options
author | Nobuyoshi Nakada <nobu@ruby-lang.org> | 2020-01-20 00:41:56 +0900 |
---|---|---|
committer | Nobuyoshi Nakada <nobu@ruby-lang.org> | 2020-01-25 14:06:38 +0900 |
commit | 0c436bbfbf3b28fab8abfcbda9b8f388fa22290a (patch) | |
tree | 44cb3e073c7583d245404150a6790dfa4f0a7840 /array.c | |
parent | 2b2821acd39530c6c786e34f304e9e018a31e5c4 (diff) |
Recheck array length after `to_str` conversion
https://hackerone.com/reports/244787
Diffstat (limited to 'array.c')
-rw-r--r-- | array.c | 4 |
1 files changed, 3 insertions, 1 deletions
@@ -2374,7 +2374,9 @@ rb_ary_join(VALUE ary, VALUE sep) if (NIL_P(tmp) || tmp != val) { int first; - result = rb_str_buf_new(len + (RARRAY_LEN(ary)-i)*10); + long n = RARRAY_LEN(ary); + if (i > n) i = n; + result = rb_str_buf_new(len + (n-i)*10); rb_enc_associate(result, rb_usascii_encoding()); i = ary_join_0(ary, sep, i, result); first = i == 0; |