string.c: guard tmp in rb_str_format_m (rubyGH-16280)

dummyx · k0kubun · commit a9b84adbd2f3 · 2026-03-03T07:57:17.000-08:00
[Bug #21931]

Keep tmp alive while RARRAY_CONST_PTR(tmp) is used by rb_str_format.

[alan: sunk the guard below usage]
Reviewed-by: Alan Wu &lt;XrXr@users.noreply.github.com&gt;
diff --git a/string.c b/string.c
@@ -2640,7 +2640,9 @@ rb_str_format_m(VALUE str, VALUE arg)
     VALUE tmp = rb_check_array_type(arg);
 
     if (!NIL_P(tmp)) {
-        return rb_str_format(RARRAY_LENINT(tmp), RARRAY_CONST_PTR(tmp), str);
+        VALUE result = rb_str_format(RARRAY_LENINT(tmp), RARRAY_CONST_PTR(tmp), str);
+        RB_GC_GUARD(tmp);
+        return result;
     }
     return rb_str_format(1, &arg, str);
 }

Original file line number	Diff line number	Diff line change
`@@ -2640,7 +2640,9 @@ rb_str_format_m(VALUE str, VALUE arg)`
`2640`	`2640`	`VALUE tmp = rb_check_array_type(arg);`
`2641`	`2641`
`2642`	`2642`	`if (!NIL_P(tmp)) {`
`2643`		`- return rb_str_format(RARRAY_LENINT(tmp), RARRAY_CONST_PTR(tmp), str);`
	`2643`	`+ VALUE result = rb_str_format(RARRAY_LENINT(tmp), RARRAY_CONST_PTR(tmp), str);`
	`2644`	`+ RB_GC_GUARD(tmp);`
	`2645`	`+ return result;`
`2644`	`2646`	`}`
`2645`	`2647`	`return rb_str_format(1, &arg, str);`
`2646`	`2648`	`}`