# Undefined method_missing null pointer dereference

Undefining BasicObject#method_missing makes mruby's __send__ and OP_SUPER paths dereference a null method pointer, segfaulting the VM.

- Payout: $8,000
- Severity: high
- Program: shopify-scripts
- Credited: h72
- Disclosed: 2016-12-17
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/181695
- Library page: https://bugbountylibrary.com/r/h1%3A181695
- Tags: domain:oss impact:dos kind:bounty platform:hackerone sev:high tech:ruby technique:source-review vuln:dos vuln:memory-corruption

**Target:** mruby VM (vm.c method dispatch: __send__ / OP_SUPER)
**Root cause:** mrb_funcall_with_block and OP_SUPER search for method_missing but don't fall back to mrb_method_missing when the search fails, leaving p null; MRB_PROC_CFUNC_P then dereferences it.
**Steps:**
1. `BasicObject.remove_method(:method_missing)`
2. `1.__send__(:foo)` triggers null deref in mrb_funcall_with_block (vm.c:362-380)
3. Alternatively: remove method_missing, define `class A; def foo; super; end; end`, then `A.new.foo` to hit OP_SUPER
**How found:** Code review of vm.c method dispatch; noticed OP_SEND has a fallback to mrb_method_missing but __send__ and OP_SUPER paths lack it, then confirmed with minimal repros.
**Exploitation:** Attacker-supplied mruby script removes method_missing then invokes __send__ or super, crashing the interpreter process (DoS).
**Insight:** When a language runtime has a fallback error path (method_missing), audit every dispatch site (__send__, super, send variants) for consistency—one path missing the fallback yields a null deref.