# NULL pointer dereference when parsing ternary operators

mruby compiler NULL-derefs in codegen NODE_IF when a ternary's condition is a spaced method call `a ()`, crashing the sandbox and enabling DoS.

- Payout: hidden
- Severity: high
- Program: Shopify
- Found by: jpenalbae
- Disclosed: 2016-12-17
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/181677
- Library page: https://bugbountylibrary.com/r/h1%3A181677
- Tags: area:oss domain:oss impact:dos kind:bounty platform:hackerone sev:high tech:ruby technique:source-review vuln:dos vuln:memory-corruption

**Target:** mruby compiler codegen (mruby-engine sandbox)
**Root cause:** In codegen's NODE_IF case, `tree->car` is NULL for a ternary whose condition parses as a spaced method call `a ()`, and `switch ((intptr_t)tree->car->car)` dereferences it.
**Steps:**
1. Submit Ruby source `b = a () ? 1 : 0` to the sandbox (`bin/sandbox /tmp/sample.rb`).
2. Parser produces a NODE_IF AST node with `tree->car == NULL`.
3. codegen reaches `switch ((intptr_t)tree->car->car)` at codegen.c:1363 and segfaults.
4. Observe crash via gdb: SIGSEGV at codegen, `rsi=0x0`, `tree->car = 0x0`.
**How found:** Noticed that inserting a space between `a` and `()` in a ternary condition crashes the sandbox; used gdb to inspect the AST node and found `tree->car` NULL at the NODE_IF codegen case, correcting gdb's misleading line attribution.
**Exploitation:** Any user able to submit a script containing the spaced-call ternary crashes the mruby engine process, causing denial of service.
**Insight:** Spacing-sensitive parser edge cases (e.g. `a ()` vs `a()`) can yield AST shapes the codegen never expects; fuzz whitespace variants around call/ternary syntax and inspect AST node fields for NULLs.