From 6cd7b1a1e9e45dd4c43c5cefc421b4c0709cdbd7 Mon Sep 17 00:00:00 2001 From: ZHIJIE XIE <40601688+dummyx@users.noreply.github.com> Date: Tue, 3 Mar 2026 02:40:57 +0900 Subject: string.c: guard tmp in rb_str_format_m (GH-16280) [Bug #21931] Keep tmp alive while RARRAY_CONST_PTR(tmp) is used by rb_str_format. [alan: sunk the guard below usage] Reviewed-by: Alan Wu --- string.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/string.c b/string.c index d5505fdb1a..500c5d3ed6 100644 --- a/string.c +++ b/string.c @@ -2409,7 +2409,9 @@ rb_str_format_m(VALUE str, VALUE arg) VALUE tmp = rb_check_array_type(arg); if (!NIL_P(tmp)) { - return rb_str_format(RARRAY_LENINT(tmp), RARRAY_CONST_PTR(tmp), str); + VALUE result = rb_str_format(RARRAY_LENINT(tmp), RARRAY_CONST_PTR(tmp), str); + RB_GC_GUARD(tmp); + return result; } return rb_str_format(1, &arg, str); } -- cgit v1.2.3