starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2020-8944 (published 2020-12-15T15:15Z)

An arbitrary memory write vulnerability in Asylo versions up to 0.6.0 allows an untrusted attacker to make a call to ecall_restore using the attribute output which fails to check the range of a pointer. An attacker can use this pointer to write to arbitrary memory addresses including those within the secure enclave We recommend upgrading past commit 382da2b8b09cbf928668a2445efb778f76bd9c8a

Severity: LOW
CVSS v2 base score: 2.1 (AV:L/AC:L/Au:N/C:N/I:P/A:N)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/google/asylo
commit_details: repo_url: https://github.com/google/asylo
author: Chong Cai
author_date: 2020-09-28 16:49:54-07:00
msg: Check output of ecall_restore is outside enclave

PiperOrigin-RevId: 334265380
Change-Id: Ifbaead6bce56f01b2a4d69f53ca508d0138f6f61
repository: repo_url: https://github.com/google/asylo
repo_name: google/asylo
description: An open and flexible framework for developing enclave applications
repo_language: C++
owner: google
file_changes: filename: ecalls.cc
change_type: ModificationType.MODIFY
diff: @@ -64,7 +64,9 @@ int ecall_restore(const char *input, uint64_t input_len, char **output,
   if (!asylo::primitives::TrustedPrimitives::IsOutsideEnclave(input,
                                                               input_len) ||
       !asylo::primitives::TrustedPrimitives::IsOutsideEnclave(
-          output_len, sizeof(uint64_t))) {
+          output_len, sizeof(uint64_t)) ||
+      !asylo::primitives::TrustedPrimitives::IsOutsideEnclave(output,
+                                                              *output_len)) {
     asylo::primitives::TrustedPrimitives::BestEffortAbort(
         "ecall_restore: input/output found to not be in untrusted memory.");
   }

programming_language: C++
CVE-2024-23823 (published 2024-03-14T19:15Z)

vantage6 is an open source framework built to enable, manage and deploy privacy enhancing technologies like Federated Learning and Multi-Party Computation. The vantage6 server has no restrictions on CORS settings. It should be possible for people to set the allowed origins of the server.  The impact is limited because v6 does not use session cookies. This issue has been addressed in commit `70bb4e1d8` and is expected to ship in subsequent releases. Users are advised to upgrade as soon as a new release is available. There are no known workarounds for this vulnerability.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/vantage6/vantage6
commit_details: repo_url: https://github.com/vantage6/vantage6
author: Bart van Beusekom
author_date: 2024-03-07 12:02:46+01:00
msg: Merge pull request from GHSA-4946-85pr-fvxh

Implement server configuration option to specification of allowed CORS origins
repository: repo_url: https://github.com/vantage6/vantage6
repo_name: vantage6/vantage6
description: The main vantage6 repository: code for the central server, nodes, CLI and Python Client
repo_language: Python
owner: vantage6
CVE-2020-15160 (published 2020-09-24T23:15Z)

PrestaShop from version 1.7.5.0 and before version 1.7.6.8 is vulnerable to a blind SQL Injection attack in the Catalog Product edition page with location parameter. The problem is fixed in 1.7.6.8

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/PrestaShop/PrestaShop
commit_details: repo_url: https://github.com/PrestaShop/PrestaShop
author: GoT
author_date: 2020-09-24 14:45:00+02:00
msg: Merge pull request from GHSA-fghq-8h87-826g

Escape location and ids when setting location
repository: repo_url: https://github.com/PrestaShop/PrestaShop
repo_name: PrestaShop/PrestaShop
description: PrestaShop is the universal open-source software platform to build your e-commerce solution.
repo_language: PHP
owner: PrestaShop
CVE-2021-32055 (published 2021-05-05T16:15Z)

Mutt 1.11.0 through 2.0.x before 2.0.7 (and NeoMutt 2019-10-25 through 2021-05-04) has a $imap_qresync issue in which imap/util.c has an out-of-bounds read in situations where an IMAP sequence set ends with a comma. NOTE: the $imap_qresync setting for QRESYNC is not enabled by default.

Severity: MEDIUM
CVSS v2 base score: 5.8 (AV:N/AC:M/Au:N/C:P/I:N/A:P)
CVSS v3 base score: 9.1, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/neomutt/neomutt
commit_details: repo_url: https://github.com/neomutt/neomutt
author: Kevin McCarthy
author_date: 2021-05-03 13:11:30-07:00
msg: Fix seqset iterator when it ends in a comma

If the seqset ended with a comma, the substr_end marker would be just
before the trailing nul.  In the next call, the loop to skip the
marker would iterate right past the end of string too.

The fix is simple: place the substr_end marker and skip past it
immediately.
repository: repo_url: https://github.com/neomutt/neomutt
repo_name: neomutt/neomutt
description: ✉️ Teaching an Old Dog New Tricks -- IRC: #neomutt on irc.libera.chat
repo_language: C
owner: neomutt
file_changes: filename: util.c
change_type: ModificationType.MODIFY
diff: @@ -1119,13 +1119,11 @@ int mutt_seqset_iterator_next(struct SeqsetIterator *iter, unsigned int *next)
     if (iter->substr_cur == iter->eostr)
       return 1;
 
-    while (!*(iter->substr_cur))
-      iter->substr_cur++;
     iter->substr_end = strchr(iter->substr_cur, ',');
     if (!iter->substr_end)
       iter->substr_end = iter->eostr;
     else
-      *(iter->substr_end) = '\0';
+      *(iter->substr_end++) = '\0';
 
     char *range_sep = strchr(iter->substr_cur, ':');
     if (range_sep)

programming_language: C
CVE-2021-24045 (published 2021-12-13T21:15Z)

A type confusion vulnerability could be triggered when resolving the "typeof" unary operator in Facebook Hermes prior to v0.10.0. Note that this is only exploitable if the application using Hermes permits evaluation of untrusted JavaScript. Hence, most React Native applications are not affected.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-843
cwe_name: Access of Resource Using Incompatible Type ('Type Confusion')
description: The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.
extended_description: 
            When the product accesses the resource using an incompatible type, this could trigger logical errors because the resource does not have expected properties. In languages without memory safety, such as C and C++, type confusion can lead to out-of-bounds memory access.
            While this weakness is frequently associated with unions when parsing data with many different embedded object types in C, it can be present in any application that can interpret the same variable or memory location in multiple ways.
            This weakness is not unique to C and C++. For example, errors in PHP applications can be triggered by providing array parameters when scalars are expected, or vice versa. Languages such as Perl, which perform automatic conversion of a variable of one type when it is accessed as if it were another type, can also contain these issues.
         
         

Fix information:
repo_url: https://github.com/facebook/hermes
commit_details: repo_url: https://github.com/facebook/hermes
author: Neil Dhar
author_date: 2021-10-13 11:18:13-07:00
msg: Handle typeof applied to empty in InstSimplify

Summary:
Do not simplify `typeof` if it is applied to an invalid type. This
handles a case like the one in the added test, where `typeof` is called
on a literal empty in unreachable code.

Reviewed By: kodafb

Differential Revision: D31000173

fbshipit-source-id: 2d7f69cbcc9c1bb0a916585c07171089444c85dc
repository: repo_url: https://github.com/facebook/hermes
repo_name: facebook/hermes
description: A JavaScript engine optimized for running React Native.
repo_language: C++
owner: facebook
file_changes: filename: IREval.cpp
change_type: ModificationType.MODIFY
diff: @@ -107,7 +107,7 @@ Literal *hermes::evalUnaryOperator(
         case ValueKind::LiteralStringKind:
           return builder.getLiteralString("string");
         default:
-          llvm_unreachable("Invalid literal kind.");
+          break;
       }
       break;
 

programming_language: C++
filename: tdz-check.js
change_type: ModificationType.MODIFY
diff: @@ -45,3 +45,8 @@ test(() => {
     return x;
 });
 //CHECK-NEXT: caught ReferenceError: accessing an uninitialized variable
+
+test(() => {
+    const foo = print(foo, typeof foo)
+});
+//CHECK-NEXT: caught ReferenceError: accessing an uninitialized variable

programming_language: C++
CVE-2022-0080 (published 2022-01-02T12:15Z)

mruby is vulnerable to Heap-based Buffer Overflow

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-122
cwe_name: Heap-based Buffer Overflow
description: A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/mruby/mruby
commit_details: repo_url: https://github.com/mruby/mruby
author: Yukihiro "Matz" Matsumoto
author_date: 2022-01-01 21:02:58+09:00
msg: proc.c: should not reference `irep` when copying failed.

It may cause broken reference count numbers.
repository: repo_url: https://github.com/mruby/mruby
repo_name: mruby/mruby
description: Lightweight Ruby
repo_language: C
owner: mruby
file_changes: filename: proc.c
change_type: ModificationType.MODIFY
diff: @@ -207,12 +207,12 @@ mrb_proc_copy(mrb_state *mrb, struct RProc *a, struct RProc *b)
     /* already initialized proc */
     return;
   }
+  if (!MRB_PROC_CFUNC_P(b) && b->body.irep) {
+    mrb_irep_incref(mrb, (mrb_irep*)b->body.irep);
+  }
   a->flags = b->flags;
   a->body = b->body;
   a->upper = b->upper;
-  if (!MRB_PROC_CFUNC_P(a) && a->body.irep) {
-    mrb_irep_incref(mrb, (mrb_irep*)a->body.irep);
-  }
   a->e.env = b->e.env;
   /* a->e.target_class = a->e.target_class; */
 }

programming_language: C
CVE-2024-31443 (published 2024-05-14T15:25Z)

Cacti provides an operational monitoring and fault management framework. Prior to 1.2.27, some of the data stored in `form_save()` function in `data_queries.php` is not thoroughly checked and is used to concatenate the HTML statement in `grow_right_pane_tree()` function from `lib/html.php` , finally resulting in cross-site scripting. Version 1.2.27 contains a patch for the issue.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/Cacti/cacti
commit_details: repo_url: https://github.com/Cacti/cacti
author: TheWitness
author_date: 2024-04-07 10:08:10-04:00
msg: Merge pull request from GHSA-rqc8-78cm-85j3

Co-authored-by: ishgard <ishgard@njust.edu.cn>
repository: repo_url: https://github.com/Cacti/cacti
repo_name: Cacti/cacti
description: Cacti ™
repo_language: PHP
owner: Cacti
file_changes: filename: html_tree.php
change_type: ModificationType.MODIFY
diff: @@ -991,6 +991,7 @@ function grow_right_pane_tree($tree_id, $leaf_id, $host_group_data) {
 			WHERE id = ?',
 			array($host_group_data_array[1]));
 
+		$name = html_escape($name);
 		$host_group_data_name = '<strong>' . __('Graph Template:'). '</strong> ' . $name;
 		$graph_template_id    = $host_group_data_array[1];
 	} elseif ($host_group_data_array[0] == 'dq') {
@@ -999,6 +1000,7 @@ function grow_right_pane_tree($tree_id, $leaf_id, $host_group_data) {
 			WHERE id = ?',
 			array($host_group_data_array[1]));
 
+		$name = html_escape($name);
 		$host_group_data_name = '<strong>' . __('Graph Template:') . '</strong> ' . (empty($host_group_data_array[1]) ? __('Non Query Based') : $name);
 		$data_query_id        = $host_group_data_array[1];
 	} elseif ($host_group_data_array[0] == 'dqi') {
@@ -1007,6 +1009,7 @@ function grow_right_pane_tree($tree_id, $leaf_id, $host_group_data) {
 			WHERE id = ?',
 			array($host_group_data_array[1]));
 
+		$name = html_escape($name);
 		$host_group_data_name = '<strong>' . __('Graph Template:') . '</strong> ' . (empty($host_group_data_array[1]) ? __('Non Query Based') : $name) . '-> ' . (empty($host_group_data_array[2]) ? __('Template Based') : get_formatted_data_query_index($leaf['host_id'], $host_group_data_array[1], $host_group_data_array[2]));
 		$data_query_id        = $host_group_data_array[1];
 		$data_query_index     = $host_group_data_array[2];

programming_language: PHP
CVE-2024-36123 (published 2024-06-03T15:15Z)

Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. The page `MediaWiki:Tagline` has its contents used unescaped, so custom HTML (including Javascript) can be injected by someone with the ability to edit the MediaWiki namespace (typically those with the `editinterface` permission, or sysops). This vulnerability is fixed in 2.16.0.\n


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/StarCitizenTools/mediawiki-skins-Citizen
commit_details: repo_url: https://github.com/StarCitizenTools/mediawiki-skins-Citizen
author: alistair3149
author_date: 2024-06-01 14:50:46-04:00
msg: fix(components): 🐛 escape the contents of MediaWiki:Tagline

Co-authored-by: BlankEclair <blankeclair@waifu.club>
repository: repo_url: https://github.com/StarCitizenTools/mediawiki-skins-Citizen
repo_name: StarCitizenTools/mediawiki-skins-Citizen
description: A beautiful, usable, responsive MediaWiki skin with in-depth extension support. Originally developed for the Star Citizen Wiki.
repo_language: Less
owner: StarCitizenTools
file_changes: filename: CitizenComponentPageHeading.php
change_type: ModificationType.MODIFY
diff: @@ -191,13 +191,13 @@ class CitizenComponentPageHeading implements CitizenComponent {
 							$tagline = $localizer->msg( 'citizen-tagline' )->parse();
 						} else {
 							// Fallback to site tagline
-							$tagline = $localizer->msg( 'tagline' )->text();
+							$tagline = $localizer->msg( 'tagline' )->parse();
 						}
 					}
 				} elseif ( !$localizer->msg( 'citizen-tagline' )->isDisabled() ) {
 					$tagline = $localizer->msg( 'citizen-tagline' )->parse();
 				} else {
-					$tagline = $localizer->msg( 'tagline' )->text();
+					$tagline = $localizer->msg( 'tagline' )->parse();
 				}
 			}
 		}

programming_language: PHP
CVE-2021-40562 (published 2022-01-12T22:15Z)

A Segmentation fault caused by a floating point exception exists in Gpac through 1.0.1 using mp4box via the naludmx_enqueue_or_dispatch function in reframe_nalu.c, which causes a denial of service.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-697
cwe_name: Incorrect Comparison
description: The product compares two entities in a security-relevant context, but the comparison is incorrect, which may lead to resultant weaknesses.
extended_description: 
            This Pillar covers several possibilities:
               
                  the comparison checks one factor incorrectly;
                  the comparison should consider multiple factors, but it does not check at least one of those factors at all;
                  the comparison checks the wrong factor.
               
         
         

Fix information:
repo_url: https://github.com/gpac/gpac
commit_details: repo_url: https://github.com/gpac/gpac
author: jeanlf
author_date: 2021-08-30 17:26:28+02:00
msg: fixed #1901
repository: repo_url: https://github.com/gpac/gpac
repo_name: gpac/gpac
description: GPAC Ultramedia OSS for Video Streaming & Next-Gen Multimedia Transcoding, Packaging & Delivery
repo_language: C
owner: gpac
file_changes: filename: reframe_nalu.c
change_type: ModificationType.MODIFY
diff: @@ -1352,9 +1352,9 @@ void naludmx_create_avc_decoder_config(GF_NALUDmxCtx *ctx, u8 **dsi, u32 *dsi_si
 					else
 						DeltaTfiDivisorIdx = (ctx->avc_state->sei.pic_timing.pic_struct+1) / 2;
 				}
-				if (!ctx->timescale) {
+				if (!ctx->timescale && sps->vui.time_scale && sps->vui.num_units_in_tick) {
 					ctx->cur_fps.num = 2 * sps->vui.time_scale;
-					ctx->cur_fps.den =  2 * sps->vui.num_units_in_tick * DeltaTfiDivisorIdx;
+					ctx->cur_fps.den = 2 * sps->vui.num_units_in_tick * DeltaTfiDivisorIdx;
 
 					if (!ctx->fps.num && ctx->dts==ctx->fps.den)
 						ctx->dts = ctx->cur_fps.den;

programming_language: C
CVE-2017-14062 (published 2017-08-31T16:29Z)

Integer overflow in the decode_digit function in puny_decode.c in Libidn2 before 2.0.4 allows remote attackers to cause a denial of service or possibly have unspecified other impact.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-190
cwe_name: Integer Overflow or Wraparound
description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
extended_description: 
            
            
            
            
         
         

Fix information:
repo_url: https://gitlab.com/libidn/libidn2
commit_details: repo_url: https://gitlab.com/libidn/libidn2
author: Tim Rühsen
author_date: 2017-08-01 11:16:47+02:00
msg: lib/puny_decode: Fix integer overflow (found by fuzzing)
repository: repo_url: https://gitlab.com/libidn/libidn2
repo_name: visit repo url
description: visit repo url
repo_language: visit repo url
owner: libidn
file_changes: filename: puny_decode.c
change_type: ModificationType.MODIFY
diff: @@ -93,10 +93,10 @@ enum { base = 36, tmin = 1, tmax = 26, skew = 38, damp = 700,
 /* point (for use in representing integers) in the range 0 to */
 /* base-1, or base if cp does not represent a value.          */
 
-static punycode_uint decode_digit(punycode_uint cp)
+static unsigned decode_digit(int cp)
 {
-  return  cp - 48 < 10 ? cp - 22 :  cp - 65 < 26 ? cp - 65 :
-          cp - 97 < 26 ? cp - 97 :  base;
+  return (unsigned) (cp - 48 < 10 ? cp - 22 :  cp - 65 < 26 ? cp - 65 :
+         cp - 97 < 26 ? cp - 97 :  base);
 }
 
 /*** Platform-specific constants ***/

programming_language: C
CVE-2022-1071 (published 2022-03-26T04:15Z)

User after free in mrb_vm_exec in GitHub repository mruby/mruby prior to 3.2.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 8.2, HIGH (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-416
cwe_name: Use After Free
description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
extended_description: 
             
             
             
			 
             
             
         
         

Fix information:
repo_url: https://github.com/mruby/mruby
commit_details: repo_url: https://github.com/mruby/mruby
author: Yukihiro "Matz" Matsumoto
author_date: 2022-03-25 12:42:12+09:00
msg: vm.c: stack may be reallocated in functions calls.

Probably due to recursive VM calls via `mrb_funcall()`.
repository: repo_url: https://github.com/mruby/mruby
repo_name: mruby/mruby
description: Lightweight Ruby
repo_language: C
owner: mruby
file_changes: filename: vm.c
change_type: ModificationType.MODIFY
diff: @@ -1394,14 +1394,16 @@ RETRY_TRY_BLOCK:
         regs[a] = mrb_ary_entry(va, mrb_integer(vb));
         break;
       case MRB_TT_HASH:
-        regs[a] = mrb_hash_get(mrb, va, vb);
+        va = mrb_hash_get(mrb, va, vb);
+        regs[a] = va;
         break;
       case MRB_TT_STRING:
         switch (mrb_type(vb)) {
         case MRB_TT_INTEGER:
         case MRB_TT_STRING:
         case MRB_TT_RANGE:
-          regs[a] = mrb_str_aref(mrb, va, vb, mrb_undef_value());
+          va = mrb_str_aref(mrb, va, vb, mrb_undef_value());
+          regs[a] = va;
           break;
         default:
           goto getidx_fallback;
@@ -1423,7 +1425,8 @@ RETRY_TRY_BLOCK:
     }
 
     CASE(OP_GETCONST, BB) {
-      regs[a] = mrb_vm_const_get(mrb, syms[b]);
+      mrb_value v = mrb_vm_const_get(mrb, syms[b]);
+      regs[a] = v;
       NEXT;
     }
 
@@ -1433,7 +1436,8 @@ RETRY_TRY_BLOCK:
     }
 
     CASE(OP_GETMCNST, BB) {
-      regs[a] = mrb_const_get(mrb, regs[a], syms[b]);
+      mrb_value v = mrb_const_get(mrb, regs[a], syms[b]);
+      regs[a] = v;
       NEXT;
     }
 
@@ -2014,14 +2018,15 @@ RETRY_TRY_BLOCK:
     CASE(OP_KARG, BB) {
       mrb_value k = mrb_symbol_value(syms[b]);
       mrb_int kidx = mrb_ci_kidx(mrb->c->ci);
-      mrb_value kdict;
+      mrb_value kdict, v;
 
       if (kidx < 0 || !mrb_hash_p(kdict=regs[kidx]) || !mrb_hash_key_p(mrb, kdict, k)) {
         mrb_value str = mrb_format(mrb, "missing keyword: %v", k);
         mrb_exc_set(mrb, mrb_exc_new_str(mrb, E_ARGUMENT_ERROR, str));
         goto L_RAISE;
       }
-      regs[a] = mrb_hash_get(mrb, kdict, k);
+      v = mrb_hash_get(mrb, kdict, k);
+      regs[a] = v;
       mrb_hash_delete_key(mrb, kdict, k);
       NEXT;
     }

programming_language: C