lib: prevent use-after-free after uc_shift()

Make sure to increase the refcount of items being moved since the
subsequent put operation will decrease it, prematurely freeing
moved items which will lead to use-after-free errors later on.

Signed-off-by: Jo-Philipp Wich <jo@mein.io>

1 files changed, 1 insertions, 1 deletions

diff --git a/lib.c b/lib.c
index 2d96aa3..23141a3 100644
--- a/lib.c
+++ b/lib.c
@@ -470,7 +470,7 @@ uc_shift(uc_vm *vm, size_t nargs)
 
 	for (arridx = 0; arridx < arrlen - 1; arridx++)
 		json_object_array_put_idx(arr, arridx,
-			json_object_array_get_idx(arr, arridx + 1));
+			uc_value_get(json_object_array_get_idx(arr, arridx + 1)));
 
 	json_object_array_del_idx(arr, arrlen - 1, 1);
 #ifdef HAVE_ARRAY_SHRINK