Null pointer dereference in mrb_random_initialize

How it was found

Sorry I was not quite sure about the scope. This bug is not triggerable in the sandbox, because it does not use the Random class, but it is triggerable in mruby with the following piece of code:

$r = Random.new
a = Object.new
def a.to_int
    $r.rand
end

$r.initialize a

The data pointer of $r is set to NULL before parsing arguments in mrb_random_init. The srand() call will try to dereference it to get the mt_state and this results in a crash.

The problem lies in mrbgems/mruby-random/src/random.c and is similar to #182274:

128   t = (mt_state*)DATA_PTR(self);
129   if (t) {
130      mrb_free(mrb, t);
131   }
132   mrb_data_init(self, NULL, &mt_state_type);
133   
134   t = (mt_state *)mrb_malloc(mrb, sizeof(mt_state));
135   t->mti = N + 1;
136   
137   seed = get_opt(mrb);        /* Move this up before line 127 */

Please let me know if you are explicitly just looking for bugs affecting the sandbox, so I won't submit invalid reports. Thanks!