From: "tekknolagi (Maxwell Bernstein) via ruby-core" Date: 2026-11-10T15:53:41+00:00 Subject: [ruby-core:127405] [Ruby Bug#22531] String#% with %s format string runs arbitrary code that can invalidate the argument array Issue #22531 has been reported by tekknolagi (Maxwell Bernstein). ---------------------------------------- Bug #22531: String#% with %s format string runs arbitrary code that can invalidate the argument array https://bugs.ruby-lang.org/issues/22531 * Author: tekknolagi (Maxwell Bernstein) * Status: Open * Target version: 4.0 * Backport: 3.3: UNKNOWN, 3.4: UNKNOWN, 4.0: UNKNOWN ---------------------------------------- For example, $a = Array.new(20) { "x" * 100 } o = Object.new def o.to_s = ($a.clear; GC.start; "o") $a[0] = o puts "%s %s %s" % $a This crashes for me with a segfault. `String#%` calls `rb_str_format_ary` with the array ptr and length of `$a` but that changes out from underneath it when `to_s` gets called and invalidates the pointer. -- https://bugs.ruby-lang.org/ ______________________________________________ ruby-core mailing list -- ruby-core@ml.ruby-lang.org To unsubscribe send an email to ruby-core-leave@ml.ruby-lang.org ruby-core info -- https://ml.ruby-lang.org/mailman3/lists/ruby-core.ml.ruby-lang.org/