heap-use-after-free in OP_RESCUE

The following input demonstrates a crash: ``` def e proc ensure z rescue yield end e { Class * def * x new { Class * 0 } ensure 0[] = 00end rescue 0 } rescue z ``` ASAN report ``` ./mruby/bin/mruby out.rb ================================================================= ==10040==ERROR: AddressSanitizer: heap-use-after-free on address 0x61d000001ec0 at pc 0x00010366ff4a bp 0x7ffeec9d44b0 sp 0x7ffeec9d3c60 WRITE of size 16 at 0x61d000001ec0 thread T0 #0 0x10366ff49 in __asan_memcpy (libclang_rt.asan_osx_dynamic.dylib:x86_64h+0x50f49) #1 0x1032c6b9c in mrb_vm_exec vm.c:1292 #2 0x1032bf1b4 in mrb_vm_run vm.c:930 #3 0x1032f5f5c in mrb_top_run vm.c:2964 #4 0x1034b4ac0 in mrb_load_exec parse.y:5840 #5 0x1034b58e5 in mrb_load_file_cxt parse.y:5849 #6 0x10322486c in main mruby.c:227 #7 0x7fff7ab3e144 in start (libdyld.dylib:x86_64+0x1144) 0x61d000001ec0 is located 64 bytes inside of 2048-byte region [0x61d000001e80,0x61d000002680) freed by thread T0 here: #0 0x1036782d0 in wrap_realloc (libclang_rt.asan_osx_dynamic.dylib:x86_64h+0x592d0) #1 0x1032ab6f5 in mrb_default_allocf state.c:55 #2 0x1033bf138 in mrb_realloc_simple gc.c:206 #3 0x1033bf8fa in mrb_realloc gc.c:220 #4 0x1032f6a04 in stack_extend_alloc vm.c:186 #5 0x1032b4def in stack_extend vm.c:207 #6 0x1032bbb30 in mrb_yield_with_class vm.c:730 #7 0x103274355 in mrb_class_initialize class.c:1613 #8 0x1032b2fc2 in mrb_funcall_with_block vm.c:481 #9 0x10327372a in mrb_class_new_class class.c:1633 #10 0x1032cb789 in mrb_vm_exec vm.c:1456 #11 0x1032bf1b4 in mrb_vm_run vm.c:930 #12 0x1032b59d4 in mrb_run vm.c:2950 #13 0x1032bc435 in mrb_yield_with_class vm.c:744 #14 0x103274355 in mrb_class_initialize class.c:1613 #15 0x1032b2fc2 in mrb_funcall_with_block vm.c:481 #16 0x10327372a in mrb_class_new_class class.c:1633 #17 0x1032cb789 in mrb_vm_exec vm.c:1456 #18 0x1032bf1b4 in mrb_vm_run vm.c:930 #19 0x1032b59d4 in mrb_run vm.c:2950 #20 0x1032bc435 in mrb_yield_with_class vm.c:744 #21 0x103274355 in mrb_class_initialize class.c:1613 #22 0x1032b2fc2 in mrb_funcall_with_block vm.c:481 #23 0x10327372a in mrb_class_new_class class.c:1633 #24 0x1032cb789 in mrb_vm_exec vm.c:1456 #25 0x1032bf1b4 in mrb_vm_run vm.c:930 #26 0x1032b59d4 in mrb_run vm.c:2950 #27 0x1032bc435 in mrb_yield_with_class vm.c:744 #28 0x103274355 in mrb_class_initialize class.c:1613 #29 0x1032b2fc2 in mrb_funcall_with_block vm.c:481 previously allocated by thread T0 here: #0 0x1036782d0 in wrap_realloc (libclang_rt.asan_osx_dynamic.dylib:x86_64h+0x592d0) #1 0x1032ab6f5 in mrb_default_allocf state.c:55 #2 0x1033bf138 in mrb_realloc_simple gc.c:206 #3 0x1033bf8fa in mrb_realloc gc.c:220 #4 0x1033c03d3 in mrb_malloc gc.c:242 #5 0x1033c046d in mrb_calloc gc.c:260 #6 0x1032b3d42 in stack_init vm.c:126 #7 0x1032b05eb in mrb_funcall_with_block vm.c:415 #8 0x1032afee9 in mrb_funcall_with_block vm.c:393 #9 0x1032af617 in mrb_funcall_argv vm.c:498 #10 0x10326cac1 in mrb_obj_new class.c:1601 #11 0x10335f1c5 in mrb_exc_new_str error.c:32 #12 0x103368881 in mrb_init_exception error.c:506 #13 0x1032ae3f4 in mrb_init_core init.c:42 #14 0x1032ab687 in mrb_open_core state.c:42 #15 0x1032ab85c in mrb_open_allocf state.c:102 #16 0x1032ab827 in mrb_open state.c:94 #17 0x103223757 in main mruby.c:171 #18 0x7fff7ab3e144 in start (libdyld.dylib:x86_64+0x1144) SUMMARY: AddressSanitizer: heap-use-after-free (libclang_rt.asan_osx_dynamic.dylib:x86_64h+0x50f49) in __asan_memcpy Shadow bytes around the buggy address: 0x1c3a00000380: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x1c3a00000390: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x1c3a000003a0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x1c3a000003b0: fd fd fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x1c3a000003c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa =>0x1c3a000003d0: fd fd fd fd fd fd fd fd[fd]fd fd fd fd fd fd fd 0x1c3a000003e0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x1c3a000003f0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x1c3a00000400: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x1c3a00000410: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x1c3a00000420: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==10040==ABORTING Abort trap: 6 ``` ## Impact Crashed on both mruby and mirb