The key or value object could be reclaimed by GC; fix #4164

The GC may occur between `sg_shift` and `mrb_assoc_new`, in which
case `key` and `value` could be freed even tough they are still alive.

The issue is found and fixed by https://hackerone.com/hexodus

1 files changed, 2 insertions, 0 deletions

diff --git a/src/hash.c b/src/hash.c
index 03a95dbd8..376c054cb 100644
--- a/src/hash.c
+++ b/src/hash.c
@@ -1057,6 +1057,8 @@ mrb_hash_shift(mrb_state *mrb, mrb_value hash)
     mrb_value del_key, del_val;
 
     sg_shift(mrb, sg, &del_key, &del_val);
+    mrb_gc_protect(mrb, del_key);
+    mrb_gc_protect(mrb, del_val);
     return mrb_assoc_new(mrb, del_key, del_val);
   }