summaryrefslogtreecommitdiff
path: root/array.c
diff options
context:
space:
mode:
authorNobuyoshi Nakada <nobu@ruby-lang.org>2020-01-20 00:29:40 +0900
committerNobuyoshi Nakada <nobu@ruby-lang.org>2020-01-25 13:57:33 +0900
commit2b2821acd39530c6c786e34f304e9e018a31e5c4 (patch)
tree1970df5e4feb6825ac0cef77ed241231735ae043 /array.c
parent92a30acbfb0813dcf551f907791bf82954a17475 (diff)
Recheck elements type after `to_str` conversion
https://hackerone.com/reports/244786
Diffstat (limited to 'array.c')
-rw-r--r--array.c6
1 files changed, 4 insertions, 2 deletions
diff --git a/array.c b/array.c
index 16321e186d..0af73715de 100644
--- a/array.c
+++ b/array.c
@@ -2286,7 +2286,7 @@ recursive_join(VALUE obj, VALUE argp, int recur)
return Qnil;
}
-static void
+static long
ary_join_0(VALUE ary, VALUE sep, long max, VALUE result)
{
long i;
@@ -2295,10 +2295,12 @@ ary_join_0(VALUE ary, VALUE sep, long max, VALUE result)
if (max > 0) rb_enc_copy(result, RARRAY_AREF(ary, 0));
for (i=0; i<max; i++) {
val = RARRAY_AREF(ary, i);
+ if (!RB_TYPE_P(val, T_STRING)) break;
if (i > 0 && !NIL_P(sep))
rb_str_buf_append(result, sep);
rb_str_buf_append(result, val);
}
+ return i;
}
static void
@@ -2374,7 +2376,7 @@ rb_ary_join(VALUE ary, VALUE sep)
int first;
result = rb_str_buf_new(len + (RARRAY_LEN(ary)-i)*10);
rb_enc_associate(result, rb_usascii_encoding());
- ary_join_0(ary, sep, i, result);
+ i = ary_join_0(ary, sep, i, result);
first = i == 0;
ary_join_1(ary, ary, sep, i, result, &first);
return result;