# Denial of Service in mruby due to null pointer dereference

Crafted mruby script with splat, case/when, and redo passes a null RArray to mrb_ary_push, causing a null-pointer dereference and segfault in mruby and mruby-engine.

- Payout: $8,000
- Severity: high
- Program: shopify-scripts
- Credited: haquaman
- Disclosed: 2016-12-17
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/181232
- Library page: https://bugbountylibrary.com/r/h1%3A181232
- Tags: domain:oss impact:dos kind:bounty platform:hackerone sev:high tech:ruby technique:fuzzing technique:reverse-engineering vuln:dos vuln:memory-corruption

**Target:** mruby interpreter / mruby-engine sandbox
**Root cause:** The VM emits an mrb_ary_push on a null RArray value produced by the splat/case/redo bytecode sequence; mrb_ary_push dereferences the null struct without a check.
**Steps:**
1. Write `crash.rb` containing `a=*"x", case "y" when "z" redo |b| "r" end`
2. Run `./dev/bin/mruby crash.rb`
3. Observe EXC_BAD_ACCESS at `ary_modify+20` with rsi=0x0
4. Load same script via mruby-engine `./bin/sandbox crash.rb` to crash the host Ruby process
**How found:** Fuzzed/minimized mruby scripts and reduced a crashing input to the minimal splat + case/when + redo construct, then used lldb to trace the fault to mrb_ary_push receiving a null RArray.
**Exploitation:** Attacker submits the crafted script to a service that evaluates untrusted mruby (e.g. Shopify Scripts via mruby-engine); the null dereference segfaults the interpreter and the embedding Ruby process, denying service.
**Insight:** Odd VM bytecode interactions between splat expansion, case/when, and redo can leave stack slots uninitialized/null; minimize crashing scripts and inspect the C backtrace to find unchecked null struct pointers in array/VM helpers.