# Exception cause SIGABRT

Overriding to_s on an exception raised inside sandboxed mruby makes mrb_exc_raise call abort(), killing the entire host Ruby process.

- Payout: hidden
- Severity: high
- Program: Shopify
- Found by: isra17
- Disclosed: 2016-12-16
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/180977
- Library page: https://bugbountylibrary.com/r/h1%3A180977
- Tags: area:oss domain:oss impact:dos kind:bounty platform:hackerone sev:high tech:ruby technique:source-review vuln:dos

**Target:** mruby sandbox engine embedded in Ruby (mruby_engine C extension)
**Root cause:** When converting the raised exception's message to a C string, mrb_convert_type fails because the overridden to_s returns non-String; mrb_raisef then calls mrb_exc_raise which aborts the process instead of propagating a catchable error.
**Steps:**
1. Write `poc.rb` defining `class A < Exception` with an empty `def to_s` body
2. Add `raise A.new`
3. Run `$ bin/sandbox poc.rb`
4. Observe SIGABRT: mrb_string_value_cstr -> mrb_str_to_str -> mrb_convert_type fails -> mrb_raisef -> mrb_exc_raise -> abort()
**How found:** Researcher inspected the mruby-engine C extension path me_mruby_engine_get_exception, which calls mrb_string_value_cstr on the exception message; hypothesized that a user-controlled to_s returning non-String would hit mrb_convert_type's failure path and abort.
**Exploitation:** Any sandboxed script that raises an exception whose to_s returns a non-String value terminates the whole host Ruby process, not just the sandbox, giving a denial of service against the embedding service.
**Insight:** In embedded interpreters, trace the host-side exception marshalling code (here mrb_string_value_cstr on the message) — any user-overridable method feeding a C conversion that calls abort() on failure is a host-process DoS.