Recheck array length after `to_str` conversion

https://hackerone.com/reports/244787

1 files changed, 11 insertions, 0 deletions

diff --git a/test/ruby/test_array.rb b/test/ruby/test_array.rb
index c3b842e950..fcfda92487 100644
--- a/test/ruby/test_array.rb
+++ b/test/ruby/test_array.rb
@@ -2457,6 +2457,17 @@ class TestArray < Test::Unit::TestCase
     assert_equal("ab012z", x.ary.join(""))
   end
 
+  def test_join_recheck_array_length
+    x = Struct.new(:ary).new
+    def x.to_str
+      ary.clear
+      ary[0] = "b"
+      "z"
+    end
+    x.ary = Array.new(1023) {"a"*1} << x
+    assert_equal("b", x.ary.join(""))
+  end
+
   def test_to_a2
     klass = Class.new(Array)
     a = klass.new.to_a