From a9b84adbd2f30eaefdf2a60341468c00e4bc090c Mon Sep 17 00:00:00 2001 From: ZHIJIE XIE <40601688+dummyx@users.noreply.github.com> Date: Tue, 3 Mar 2026 02:40:57 +0900 Subject: string.c: guard tmp in rb_str_format_m (GH-16280) [Bug #21931] Keep tmp alive while RARRAY_CONST_PTR(tmp) is used by rb_str_format. [alan: sunk the guard below usage] Reviewed-by: Alan Wu --- string.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/string.c b/string.c index 516fc81b93..e4ed93baf8 100644 --- a/string.c +++ b/string.c @@ -2640,7 +2640,9 @@ rb_str_format_m(VALUE str, VALUE arg) VALUE tmp = rb_check_array_type(arg); if (!NIL_P(tmp)) { - return rb_str_format(RARRAY_LENINT(tmp), RARRAY_CONST_PTR(tmp), str); + VALUE result = rb_str_format(RARRAY_LENINT(tmp), RARRAY_CONST_PTR(tmp), str); + RB_GC_GUARD(tmp); + return result; } return rb_str_format(1, &arg, str); } -- cgit v1.2.3