# Range constructor type confusion DoS

Redefining the Range constant in mruby causes mrb_range_new to allocate a range backed by the wrong struct, leading to type confusion and a segfault crash.

- Payout: $10,000
- Severity: high
- Program: shopify-scripts
- Credited: h72
- Disclosed: 2016-12-17
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/181910
- Library page: https://bugbountylibrary.com/r/h1%3A181910
- Tags: domain:oss impact:dos kind:bounty platform:hackerone sev:high tech:ruby technique:source-review vuln:dos vuln:memory-corruption

**Target:** mruby interpreter (Range literal construction)
**Root cause:** mrb_range_new uses runtime constant lookup to find the Range class instead of a cached class reference, so redefining Range makes it allocate an RRange struct while the object is treated as another class, confusing RRange::edges with the iv field.
**Steps:**
1. Run mruby with `Range = Array`
2. Execute `(1..2).inspect`
3. Observe segfault from struct field type confusion
**How found:** Noticed mrb_range_new performs runtime constant lookup for the Range class, unlike other core classes that cache their class in mrb_state, and hypothesized redefining the constant would cause struct confusion.
**Exploitation:** Attacker supplying mruby code can redefine the Range constant and trigger a range literal to crash the interpreter; RCE was theorized but not demonstrated.
**Insight:** In embedded interpreters, audit core constructors that do runtime constant lookup instead of using cached class pointers in mrb_state; redefining core constants like Range/Array can turn struct layout assumptions into type confusion.