How it was found

Hey again!

Founded another missing best practice in mruby. That allow an attacker to Delete (pop) or clear the Frozen ARRAY. This report is similar to 194866 POC

$a = [1,2,3,4,5].freeze

$a.pop

"#=> This will give 5 and $a will become [1,2,3,4]"

$a.shift

"#=> This will give 1 and $a will become [2,3,4,5]"

$a.clear

"#=> This will clear the whole FROZEN ARRAY."

Explanation

The issue is in mrb_ary_pop , mrb_ary_shift & in mrb_ary_clear methods of Array.c because there is no method calling to check the weather the Array is frozen or not. I'm not too much familiar with ruby to determine its impact, may be it doesn't effect at all but it should be fix.

Fix

Apply ary_modify method in all above mentioned methods.