hitoshura25/cvefixes huggingface dataset:
CVE-2013-0212 (Python, published 2013-02-24T21:55Z)
Description: value: store/swift.py in OpenStack Glance Essex (2012.1), Folsom (2012.2) before 2012.2.3, and Grizzly, when in Swift single tenant mode, logs the Swift endpoint's user name and password in cleartext when the endpoint is misconfigured or unusable, allows remote authenticated users to obtain sensitive information by reading the error messages.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/openstack/glance
Files changed:
glance/store/swift.py
Commit message: Remove Swift location/password from messages.

Updates several exceptions and log messages in the Swift backend
so that they don't include Swift location URI's which may contain
passwords when used in Swift single tenant mode.

Fixes LP Bug #1098962.

Change-Id: I458de58563343347d5c976fe1ad084cc7e3280eb


Vulnerable code:
            LOG.debug(_("Invalid store uri %(uri)s: %(reason)s") % locals())
                reason = (_("Badly formed credentials '%(creds)s' in Swift "
                            "URI") % locals())
            reason = _("Badly formed Swift URI: %s") % uri
                raise exception.NotFound(_("Swift could not find image at "
                                           "uri %(uri)s") % locals())
                                            "location %s") %
                                          location.get_uri())
                raise exception.NotFound(_("Swift could not find image at "
                                           "uri %(uri)s") % locals())
                raise exception.NotFound(_("Swift could not find image at "
                                           "uri %(uri)s") % locals())

Fixed code:
            LOG.debug(_("Invalid store URI: %(reason)s") % locals())
                reason = (_("Badly formed credentials in Swift URI."))
            reason = _("Badly formed Swift URI.")
                msg = _("Swift could not find image at URI.")
                raise exception.NotFound(msg)
                                            "this location"))
                msg = _("Swift could not find image at URI.")
                raise exception.NotFound(msg)
                msg = _("Swift could not find image at URI.")
                raise exception.NotFound(msg)
CVE-2023-45139 (Python, published 2024-01-10T16:15Z)
Description: value: fontTools is a library for manipulating fonts, written in Python. The subsetting module has a XML External Entity Injection (XXE) vulnerability which allows an attacker to resolve arbitrary entities when a candidate font (OT-SVG fonts), which contains a SVG table, is parsed. This allows attackers to include arbitrary files from the filesystem fontTools is running on or make web requests from the host system. This vulnerability has been patched in version 4.43.0.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-611 \u2014 Improper Restriction of XML External Entity Reference
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
Repository: https://github.com/fonttools/fonttools
Files changed:
Lib/fontTools/subset/svg.py
Commit message: subset: parse OT-SVG with resolve_entities=False

to guard against XXE attacks as recommended in https://codeql.github.com/codeql-query-help/python/py-xxe/


Vulnerable code:

Fixed code:
                # don't replace entities; we don't expect any in OT-SVG and they may
                # aboused for XXE attacks
                resolve_entities=False,
CVE-2017-10910 (JavaScript, published 2017-12-28T02:29Z)
Description: value: MQTT.js 2.x.x prior to 2.15.0 issue in handling PUBLISH tickets may lead to an attacker causing a denial-of-service condition.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-674 \u2014 Uncontrolled Recursion
The product does not properly control the amount of recursion that takes place,  consuming excessive resources, such as allocated memory or the program stack.
Repository: https://github.com/mqttjs/MQTT.js
Files changed:
lib/client.js
test/client.js
Commit message: Do not stack overflow if a TCP frame contains too many PUBLISH


Vulnerable code:
  function process () {
      that._handlePacket(packet, process)
    process()

Fixed code:
  function nextTickWork () {
    process.nextTick(work)
  }

  function work () {
      that._handlePacket(packet, nextTickWork)
    work()
var mqttPacket = require('mqtt-packet')
var Buffer = require('safe-buffer').Buffer
var Duplex = require('readable-stream').Duplex

    it('should not go overflow if the TCP frame contains a lot of PUBLISH packets', function (done) {
      var parser = mqttPacket.parser()
      var count = 0
      var max = 1000
      var duplex = new Duplex({
        read: function (n) {},
        write: function (chunk, enc, cb) {
          parser.parse(chunk)
          cb() // nothing to do
        }
      })
      var client = new mqtt.MqttClient(function () {
        return duplex
      }, {})

      client.on('message', function (t, p, packet) {
        if (++count === max) {
          done()
        }
      })

      parser.on('packet', function (packet) {
        var packets = []

        if (packet.cmd === 'connect') {
          duplex.push(mqttPacket.generate({
            cmd: 'connack',
            sessionPresent: false,
            returnCode: 0
          }))

          for (var i = 0; i < max; i++) {
            packets.push(mqttPacket.generate({
              cmd: 'publish',
              topic: Buffer.from('hello'),
              payload: Buffer.from('world'),
              retain: false,
              dup: false,
              messageId: i + 1,
              qos: 1
            }))
          }

          duplex.push(Buffer.concat(packets))
        }
      })
    })
CVE-2019-25100 (PHP, published 2023-01-08T11:15Z)
Description: value: A vulnerability was found in happyman twmap. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file twmap3/data/ajaxCRUD/pointdata2.php. The manipulation of the argument id leads to sql injection. Upgrading to version v2.9_v4.31 is able to address this issue. The identifier of the patch is babbec79b3fa4efb3bd581ea68af0528d11bba0c. It is recommended to upgrade the affected component. The identifier VDB-217645 was assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/happyman/twmap
Files changed:
twmap3/data/ajaxCRUD/pointdata2.php
twmap3/data/ajaxCRUD_old/pointdata2.php
Commit message: #42 fix SQL-Injection


Vulnerable code:
	$sql .= " where id = $id";
	$sql .= " where id = $id";

Fixed code:
	$sql .= " where id = ". pg_escape_string($id);
	$sql .= " where id = ".pg_escape_string($id);
CVE-2017-9527 (C, published 2017-06-11T17:29Z)
Description: value: The mark_context_stack function in gc.c in mruby through 1.2.0 allows attackers to cause a denial of service (heap-based use-after-free and application crash) or possibly have unspecified other impact via a crafted .rb file.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/mruby/mruby
Files changed:
src/gc.c
Commit message: Clear unused stack region that may refer freed objects; fix #3596


Vulnerable code:
      if (mrb_basic_ptr(v)->tt == MRB_TT_FREE) {
        c->stbase[i] = mrb_nil_value();
      }
      else {
        mrb_gc_mark(mrb, mrb_basic_ptr(v));
      }

Fixed code:
  mrb_value nil;
      mrb_gc_mark(mrb, mrb_basic_ptr(v));
  e = c->stend - c->stbase;
  nil = mrb_nil_value();
  for (; i<e; i++) {
    c->stbase[i] = nil;
  }
CVE-2018-10191 (C, published 2018-04-17T21:29Z)
Description: value: In versions of mruby up to and including 1.4.0, an integer overflow exists in src/vm.c::mrb_vm_exec() when handling OP_GETUPVAR in the presence of deep scope nesting, resulting in a use-after-free. An attacker that can cause Ruby code to be run can use this to possibly execute arbitrary code.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/mruby/mruby
Files changed:
src/vm.c
Commit message: Check length of env stack before accessing upvar; fix #3995


Vulnerable code:
      if (!e) {
        *regs_a = mrb_nil_value();
        *regs_a = e->stack[b];

Fixed code:
      if (e && b < MRB_ENV_STACK_LEN(e)) {
        *regs_a = e->stack[b];
        *regs_a = mrb_nil_value();
CVE-2018-10199 (C, published 2018-04-18T15:29Z)
Description: value: In versions of mruby up to and including 1.4.0, a use-after-free vulnerability exists in src/io.c::File#initilialize_copy(). An attacker that can cause Ruby code to be run can possibly use this to execute arbitrary code.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/mruby/mruby
Files changed:
mrbgems/mruby-io/src/io.c
Commit message: Fix `use after free in File#initilialize_copy`; fix #4001

The bug and the fix were reported by https://hackerone.com/pnoltof


Vulnerable code:
  fptr_orig = io_get_open_fptr(mrb, orig);

Fixed code:
  fptr_orig = io_get_open_fptr(mrb, orig);
CVE-2018-11743 (C, published 2018-06-05T13:29Z)
Description: value: The init_copy function in kernel.c in mruby 1.4.1 makes initialize_copy calls for TT_ICLASS objects, which allows attackers to cause a denial of service (mrb_hash_keys uninitialized pointer and application crash) or possibly have unspecified other impact.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-824 \u2014 Access of Uninitialized Pointer
The product accesses or uses a pointer that has not been initialized.
Repository: https://github.com/mruby/mruby
Files changed:
src/kernel.c
Commit message: Should not call `initialize_copy` for `TT_ICLASS`; fix #4027

Since `TT_ICLASS` is a internal object that should never be revealed
to Ruby world.


Vulnerable code:

Fixed code:
    case MRB_TT_ICLASS:
      copy_class(mrb, dest, obj);
      return;
CVE-2018-12247 (C, published 2018-06-12T14:29Z)
Description: value: An issue was discovered in mruby 1.4.1. There is a NULL pointer dereference in mrb_class, related to certain .clone usage, because mrb_obj_clone in kernel.c copies flags other than the MRB_FLAG_IS_FROZEN flag (e.g., the embedded flag).
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/mruby/mruby
Files changed:
src/kernel.c
Commit message: Allow `Object#clone` to copy frozen status only; fix #4036

Copying all flags from the original object may overwrite the clone's
flags e.g. the embedded flag.


Vulnerable code:
  p->flags = mrb_obj_ptr(self)->flags;

Fixed code:
  p->flags |= mrb_obj_ptr(self)->flags & MRB_FLAG_IS_FROZEN;
CVE-2018-12248 (C, published 2018-06-12T14:29Z)
Description: value: An issue was discovered in mruby 1.4.1. There is a heap-based buffer over-read associated with OP_ENTER because mrbgems/mruby-fiber/src/fiber.c does not extend the stack in cases of many arguments to fiber.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/mruby/mruby
Files changed:
mrbgems/mruby-fiber/src/fiber.c
Commit message: Extend stack when pushing arguments that does not fit in; fix #4038


Vulnerable code:
  if (resume && c->status == MRB_FIBER_TRANSFERRED) {
  if (c->status == MRB_FIBER_RUNNING || c->status == MRB_FIBER_RESUMED) {
  if (c->status == MRB_FIBER_TERMINATED) {
  mrb->c->status = resume ? MRB_FIBER_RESUMED : MRB_FIBER_TRANSFERRED;
  if (c->status == MRB_FIBER_CREATED) {
    if (len >= c->stend - c->stack) {
      mrb_raise(mrb, E_FIBER_ERROR, "too many arguments to fiber");
    }
  fiber_switch_context(mrb, c);

Fixed code:
  enum mrb_fiber_state status;
  status = c->status;
  if (resume && status == MRB_FIBER_TRANSFERRED) {
  if (status == MRB_FIBER_RUNNING || status == MRB_FIBER_RESUMED) {
  if (status == MRB_FIBER_TERMINATED) {
  old_c->status = resume ? MRB_FIBER_RESUMED : MRB_FIBER_TRANSFERRED;
  fiber_switch_context(mrb, c);
  if (status == MRB_FIBER_CREATED) {
    mrb_stack_extend(mrb, len+2); /* for receiver and (optional) block */
CVE-2018-12249 (C, published 2018-06-12T14:29Z)
Description: value: An issue was discovered in mruby 1.4.1. There is a NULL pointer dereference in mrb_class_real because "class BasicObject" is not properly supported in class.c.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/mruby/mruby
Files changed:
src/class.c
Commit message: `mrb_class_real()` did not work for `BasicObject`; fix #4037


Vulnerable code:
  if (cl == 0)
    return NULL;

Fixed code:
  if (cl == 0) return NULL;
    if (cl == 0) return NULL;
CVE-2020-36401 (C, published 2021-07-01T03:15Z)
Description: value: mruby 2.1.2 has a double free in mrb_default_allocf (called from mrb_free and obj_free).
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-415 \u2014 Double Free
The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
Repository: https://github.com/mruby/mruby
Files changed:
src/gc.c
Commit message: Cancel 9cdf439

Should not free the pointer in `realloc` since it can cause
use-after-free problem.


Vulnerable code:
    mrb_free(mrb, p);

Fixed code:
CVE-2021-4110 (C, published 2021-12-15T05:15Z)
Description: value: mruby is vulnerable to NULL Pointer Dereference
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/mruby/mruby
Files changed:
include/mruby/proc.h
src/class.c
src/proc.c
Commit message: proc.c: add `mrb_state` argument to `mrb_proc_copy()`.

The function may invoke the garbage collection and it requires
`mrb_state` to run.


Vulnerable code:
void mrb_proc_copy(struct RProc *a, struct RProc *b);
  mrb_proc_copy(p, mrb_proc_ptr(blk));
mrb_proc_copy(struct RProc *a, struct RProc *b)
    mrb_irep_incref(NULL, (mrb_irep*)a->body.irep);
  a->upper = b->upper;
  mrb_proc_copy(p, mrb_proc_ptr(blk));
  mrb_proc_copy(mrb_proc_ptr(self), mrb_proc_ptr(proc));
    mrb_proc_copy(p2, p);

Fixed code:
void mrb_proc_copy(mrb_state *mrb, struct RProc *a, struct RProc *b);
  mrb_proc_copy(mrb, p, mrb_proc_ptr(blk));
mrb_proc_copy(mrb_state *mrb, struct RProc *a, struct RProc *b)
  a->upper = b->upper;
    mrb_irep_incref(mrb, (mrb_irep*)a->body.irep);
  mrb_proc_copy(mrb, p, mrb_proc_ptr(blk));
  mrb_proc_copy(mrb, mrb_proc_ptr(self), mrb_proc_ptr(proc));
    mrb_proc_copy(mrb, p2, p);
CVE-2021-4188 (C, published 2021-12-30T07:15Z)
Description: value: mruby is vulnerable to NULL Pointer Dereference
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/mruby/mruby
Files changed:
src/array.c
Commit message: array.c: fix `mrb_ary_shift_m` initialization bug.

The `ARY_PTR` and `ARY_LEN` may be modified in `mrb_get_args`.


Vulnerable code:
  struct RArray *a = mrb_ary_ptr(self);
  mrb_int len = ARY_LEN(a);
  mrb_value val;
  };

Fixed code:
  }

  struct RArray *a = mrb_ary_ptr(self);
  mrb_int len = ARY_LEN(a);
  mrb_value val;
CVE-2022-0080 (C, published 2022-01-02T12:15Z)
Description: value: mruby is vulnerable to Heap-based Buffer Overflow
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-122 \u2014 Heap-based Buffer Overflow
A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
Repository: https://github.com/mruby/mruby
Files changed:
src/proc.c
Commit message: proc.c: should not reference `irep` when copying failed.

It may cause broken reference count numbers.


Vulnerable code:
  if (!MRB_PROC_CFUNC_P(a) && a->body.irep) {
    mrb_irep_incref(mrb, (mrb_irep*)a->body.irep);
  }

Fixed code:
  if (!MRB_PROC_CFUNC_P(b) && b->body.irep) {
    mrb_irep_incref(mrb, (mrb_irep*)b->body.irep);
  }
CVE-2022-0240 (C, published 2022-01-17T14:15Z)
Description: value: mruby is vulnerable to NULL Pointer Dereference
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/mruby/mruby
Files changed:
src/class.c
Commit message: class.c: add `obj->c` check before `prepare_singleton_class()`.


Vulnerable code:

Fixed code:
  mrb_assert(o->c);
  if (obj->c == NULL) return NULL;
CVE-2022-0326 (C, published 2022-01-21T07:15Z)
Description: value: NULL Pointer Dereference in Homebrew mruby prior to 3.2.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/mruby/mruby
Files changed:
mrbgems/mruby-compiler/core/codegen.c
Commit message: codegen.c: no `OP_HASHADD` required when `val` is false.


Vulnerable code:
    if (len > 0) {
  if (update) return -1;

Fixed code:
    if (val && len > 0) {
CVE-2022-0481 (C, published 2022-02-04T23:15Z)
Description: value: NULL Pointer Dereference in Homebrew mruby prior to 3.2.
Severity: HIGH (CVSS v3 base score: 7.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/mruby/mruby
Files changed:
mrbgems/mruby-compiler/core/codegen.c
Commit message: codegen.c: fixed a bug in hash code generation with `!val`.


Vulnerable code:
      if (len > 0) {
      if (len > 0 || update) {

Fixed code:
      if (val && len > 0) {
      if (val && (len > 0 || update)) {
CVE-2022-0525 (C, published 2022-02-09T04:15Z)
Description: value: Out-of-bounds Read in Homebrew mruby prior to 3.2.
Severity: MEDIUM (CVSS v3 base score: 9.1)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/mruby/mruby
Files changed:
mrbgems/mruby-compiler/core/codegen.c
Commit message: codegen.c: stack position may be wrong on assignments.

When `[]=` access includes keyword arguments.


Vulnerable code:
            push();
            pop();

Fixed code:
          if (n == 14) {
            pop_n(n);
            genop_2(s, OP_ARRAY, cursp(), n);
            push();
            n = 15;
          }
            pop_n(2);
          push();
CVE-2022-0570 (C, published 2022-02-14T12:15Z)
Description: value: Heap-based Buffer Overflow in Homebrew mruby prior to 3.2.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-122 \u2014 Heap-based Buffer Overflow
A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
Repository: https://github.com/mruby/mruby
Files changed:
mrbgems/mruby-compiler/core/codegen.c
Commit message: codegen.c: fix a bug in `gen_values()`.

- Fix limit handling that fails 15 arguments method calls.
- Fix too early argument packing in arrays.


Vulnerable code:
    if (is_splat || n > limit || cursp() >= slimit) { /* flush stack */

Fixed code:
    if (is_splat || cursp() >= slimit) { /* flush stack */
  else if (n > limit) {
    pop_n(n);
    genop_2(s, OP_ARRAY, cursp(), n);
    return -1;
  }
CVE-2022-0614 (C, published 2022-02-16T10:15Z)
Description: value: Use of Out-of-range Pointer Offset in Homebrew mruby prior to 3.2.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/mruby/mruby
Files changed:
src/vm.c
Commit message: vm.c: should check type before hash access.

Since the operand of double splat (`**`) may not be a hash, simple
assertion (previous code since d42a64e) was not enough for this case.


Vulnerable code:
      mrb_assert(mrb_hash_p(hash));

Fixed code:
      mrb_ensure_hash_type(mrb, hash);
CVE-2022-0623 (C, published 2022-02-17T07:15Z)
Description: value: Out-of-bounds Read in Homebrew mruby prior to 3.2.
Severity: MEDIUM (CVSS v3 base score: 9.1)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/mruby/mruby
Files changed:
src/vm.c
Commit message: vm.c: should check type before hash access.

Since the operand of double splat (`**`) may not be a hash, simple
assertion (previous code since d42a64e) was not enough for this case.


Vulnerable code:
      mrb_assert(mrb_hash_p(hash));

Fixed code:
      mrb_ensure_hash_type(mrb, hash);
CVE-2022-0630 (C, published 2022-02-19T14:15Z)
Description: value: Out-of-bounds Read in Homebrew mruby prior to 3.2.
Severity: MEDIUM (CVSS v3 base score: 7.1)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/mruby/mruby
Files changed:
src/vm.c
Commit message: vm.c: should check type before hash access.

Since the operand of double splat (`**`) may not be a hash, simple
assertion (previous code since d42a64e) was not enough for this case.


Vulnerable code:
      mrb_assert(mrb_hash_p(hash));

Fixed code:
      mrb_ensure_hash_type(mrb, hash);