https://git.ruby-lang.org/ruby.git/commit/?id=2b2821acd3

From 2b2821acd39530c6c786e34f304e9e018a31e5c4 Mon Sep 17 00:00:00 2001
From: Nobuyoshi Nakada <nobu@r...>
Date: Mon, 20 Jan 2020 00:29:40 +0900
Subject: Recheck elements type after `to_str` conversion

https://hackerone.com/reports/244786

diff --git a/array.c b/array.c
index 16321e1..0af7371 100644
--- a/array.c
+++ b/array.c
@@ -2286,7 +2286,7 @@ recursive_join(VALUE obj, VALUE argp, int recur) https://github.com/ruby/ruby/blob/trunk/array.c#L2286
     return Qnil;
 }
 
-static void
+static long
 ary_join_0(VALUE ary, VALUE sep, long max, VALUE result)
 {
     long i;
@@ -2295,10 +2295,12 @@ ary_join_0(VALUE ary, VALUE sep, long max, VALUE result) https://github.com/ruby/ruby/blob/trunk/array.c#L2295
     if (max > 0) rb_enc_copy(result, RARRAY_AREF(ary, 0));
     for (i=0; i<max; i++) {
 	val = RARRAY_AREF(ary, i);
+        if (!RB_TYPE_P(val, T_STRING)) break;
 	if (i > 0 && !NIL_P(sep))
 	    rb_str_buf_append(result, sep);
 	rb_str_buf_append(result, val);
     }
+    return i;
 }
 
 static void
@@ -2374,7 +2376,7 @@ rb_ary_join(VALUE ary, VALUE sep) https://github.com/ruby/ruby/blob/trunk/array.c#L2376
 	    int first;
 	    result = rb_str_buf_new(len + (RARRAY_LEN(ary)-i)*10);
 	    rb_enc_associate(result, rb_usascii_encoding());
-	    ary_join_0(ary, sep, i, result);
+            i = ary_join_0(ary, sep, i, result);
 	    first = i == 0;
 	    ary_join_1(ary, ary, sep, i, result, &first);
 	    return result;
diff --git a/test/ruby/test_array.rb b/test/ruby/test_array.rb
index 476cf79..c3b842e 100644
--- a/test/ruby/test_array.rb
+++ b/test/ruby/test_array.rb
@@ -2447,6 +2447,16 @@ class TestArray < Test::Unit::TestCase https://github.com/ruby/ruby/blob/trunk/test/ruby/test_array.rb#L2447
     assert_equal("12345", [1,[2,[3,4],5]].join)
   end
 
+  def test_join_recheck_elements_type
+    x = Struct.new(:ary).new
+    def x.to_str
+      ary[2] = [0, 1, 2]
+      "z"
+    end
+    (x.ary = ["a", "b", "c", x])
+    assert_equal("ab012z", x.ary.join(""))
+  end
+
   def test_to_a2
     klass = Class.new(Array)
     a = klass.new.to_a
-- 
cgit v0.10.2


--
ML: ruby-changes@q...
Info: http://www.atdot.net/~ko1/quickml/