Bug #22531: String#% with %s format string runs arbitrary code that can invalidate the argument array

• Status: Open
• Assignee: -
• Target version: 4.0
• Backport: 3.3: UNKNOWN, 3.4: UNKNOWN, 4.0: UNKNOWN

[tekknolagi (Maxwell Bernstein)]

For example,

$a = Array.new(20) { "x" * 100 }
o = Object.new
def o.to_s = ($a.clear; GC.start; "o")
$a[0] = o
puts "%s %s %s" % $a

This crashes for me with a segfault.

String#% calls rb_str_format_ary with the array ptr and length of $a but that changes out from underneath it when to_s gets called and invalidates the pointer.