From 46f51cb3a26e5bfc92251e7971697a9c31bcab44 Mon Sep 17 00:00:00 2001 From: ZHIJIE XIE <40601688+dummyx@users.noreply.github.com> Date: Tue, 3 Mar 2026 02:40:57 +0900 Subject: string.c: guard tmp in rb_str_format_m (GH-16280) [Bug #21931] Keep tmp alive while RARRAY_CONST_PTR(tmp) is used by rb_str_format. [alan: sunk the guard below usage] Reviewed-by: Alan Wu --- string.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/string.c b/string.c index 5a093ff291..108c21cb16 100644 --- a/string.c +++ b/string.c @@ -2557,7 +2557,9 @@ rb_str_format_m(VALUE str, VALUE arg) VALUE tmp = rb_check_array_type(arg); if (!NIL_P(tmp)) { - return rb_str_format(RARRAY_LENINT(tmp), RARRAY_CONST_PTR(tmp), str); + VALUE result = rb_str_format(RARRAY_LENINT(tmp), RARRAY_CONST_PTR(tmp), str); + RB_GC_GUARD(tmp); + return result; } return rb_str_format(1, &arg, str); } -- cgit v1.2.3