Recheck array length after `to_str` conversion

https://hackerone.com/reports/244787

1 files changed, 3 insertions, 1 deletions

diff --git a/array.c b/array.c
index 0af73715de..7925b26e07 100644
--- a/array.c
+++ b/array.c
@@ -2374,7 +2374,9 @@ rb_ary_join(VALUE ary, VALUE sep)
 
 	if (NIL_P(tmp) || tmp != val) {
 	    int first;
-	    result = rb_str_buf_new(len + (RARRAY_LEN(ary)-i)*10);
+            long n = RARRAY_LEN(ary);
+            if (i > n) i = n;
+            result = rb_str_buf_new(len + (n-i)*10);
 	    rb_enc_associate(result, rb_usascii_encoding());
             i = ary_join_0(ary, sep, i, result);
 	    first = i == 0;