diff options
| author | Jeremy Evans <[email protected]> | 2025-05-03 11:07:22 -0700 |
|---|---|---|
| committer | Jeremy Evans <[email protected]> | 2025-05-04 04:10:57 +0900 |
| commit | be665cf855d7b35ce166ea1137d4f8d0cac1010b (patch) | |
| tree | 9da637d7922023c383b3edff23f6c6852a269456 /test | |
| parent | f3246ccebb0ccb8667fc6f143e69ecc2a9e3fb3c (diff) | |
Handle mutation of array being merged into set
Check length of array during every iteration, as a #hash method
could truncate the array, resulting in heap-use-after-free.
Fixes [Bug #21305]
Notes
Notes:
Merged: https://github.com/ruby/ruby/pull/13253
Diffstat (limited to 'test')
| -rw-r--r-- | test/ruby/test_set.rb | 11 |
1 files changed, 11 insertions, 0 deletions
diff --git a/test/ruby/test_set.rb b/test/ruby/test_set.rb index 2de6cdaaee..225b7da78c 100644 --- a/test/ruby/test_set.rb +++ b/test/ruby/test_set.rb @@ -632,6 +632,17 @@ class TC_Set < Test::Unit::TestCase } end + def test_merge_mutating_hash_bug_21305 + a = (1..100).to_a + o = Object.new + o.define_singleton_method(:hash) do + a.clear + 0 + end + a.unshift o + assert_equal([o], Set.new.merge(a).to_a) + end + def test_subtract set = Set[1,2,3] |