# SIGSEGV when invalid argument on remove_method

mruby's remove_method with a non-symbol argument (nil, int, float, string, class) triggers a NULL-ish pointer deref in mrb_class, crashing the Shopify Scripts sandbox (DoS).

- Payout: hidden
- Severity: high
- Program: Shopify
- Found by: jpenalbae
- Disclosed: 2016-12-17
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/181874
- Library page: https://bugbountylibrary.com/r/h1%3A181874
- Tags: area:oss domain:oss impact:dos kind:bounty platform:hackerone sev:high tech:ruby technique:fuzzing technique:source-review vuln:dos vuln:memory-corruption

**Target:** mruby sandbox engine (mrb_mod_remove_method)
**Root cause:** remove_method accepts any mrb_value and passes it to mrb_symbol() without type checking; when the method isn't found, mrb_name_error formats the bogus symbol via mrb_sym2str, and mrb_check_convert_type calls mrb_respond_to on a non-object value, dereferencing mrb_obj_ptr(v)->c at address 0xe.
**Steps:**
1. Run the sandbox: `ruby bin/sandbox /tmp/crasher.rb`
2. Submit script: `class Child\n  remove_method nil\nend`
3. Also crashes with `remove_method 1`, `remove_method 2.123`, `remove_method 'aaaa'`, `remove_method Child`
4. Observe SIGSEGV in mrb_class via mrb_respond_to -> mrb_check_convert_type -> mrb_check_string_type -> join_ary -> mrb_vformat -> mrb_name_error -> remove_method
**How found:** Fuzzing/type-variation of remove_method arguments; gdb backtrace traced the crash from mrb_mod_remove_method through mrb_name_error's format string handling into mrb_class's default branch dereferencing a non-object mrb_value.
**Exploitation:** Any user able to submit a Shopify Script can crash the mruby sandbox worker by calling remove_method with a non-symbol argument, causing a segmentation fault and denial of service of the script execution service.
**Insight:** Error-formatting paths that convert arbitrary mrb_values to strings (mrb_name_error with %S) can reach mrb_class on non-object types; audit every mrb_get_args("*") consumer that later assumes symbol/object types, especially in error branches.