# SIGSEV on mrb_ary_splice

Self-referential array splice in mruby sandbox triggers SIGSEGV in mrb_ary_splice via mrb_type on corrupted value, crashing the Shopify Scripts sandbox.

- Payout: hidden
- Severity: high
- Program: Shopify
- Found by: jpenalbae
- Disclosed: 2016-12-17
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/182027
- Library page: https://bugbountylibrary.com/r/h1%3A182027
- Tags: area:oss domain:oss impact:dos kind:bounty platform:hackerone sev:high tech:ruby technique:source-review vuln:dos vuln:memory-corruption

**Target:** mruby sandbox array splice (mrb_ary_splice)
**Root cause:** Assigning an array into a zero-length slice of itself (t0me[0,0]=t0me) causes mrb_ary_splice to write a value whose type word is corrupted, so mrb_type() dereferences an invalid pointer in mrb_field_write_barrier_value.
**Steps:**
1. Run sandbox with script: `t0me=methods` then `t0me[0,0]=t0me`
2. mrb_ary_aset calls mrb_ary_splice with head=0, len=0, rpl=self
3. In the write-barrier loop, mrb_type(argv[i]) reads a corrupted value word (0x5200000004)
4. mrb_immediate_p dereferences o.value.bp->tt at invalid address, causing SIGSEGV
**How found:** Researcher fuzzed/experimented with array slice assignment where the replacement is the array itself, then debugged the crash in gdb down to mrb_field_write_barrier_value and mrb_type.
**Exploitation:** Attacker submits a script to the sandboxed mruby engine; the self-splice crashes the interpreter thread, DoS-ing the service processing the script.
**Insight:** Self-referential array mutations (arr[0,0]=arr) can corrupt mruby value boxing; audit splice/aset paths where source and destination arrays alias.