# SIGSEGV on mruby mrb_str_modify() (Invalid memory access)

Crafted mruby heredoc/string-concat script passes an invalid RString pointer to mrb_str_modify, causing SIGSEGV and DoS of the Shopify Scripts sandbox.

- Payout: hidden
- Severity: high
- Program: Shopify
- Found by: jpenalbae
- Disclosed: 2016-12-17
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/183231
- Library page: https://bugbountylibrary.com/r/h1%3A183231
- Tags: area:oss domain:oss impact:dos kind:bounty platform:hackerone sev:high tech:ruby technique:fuzzing technique:source-review vuln:dos vuln:memory-corruption

**Target:** mruby sandbox engine (mrb_str_concat/mrb_str_modify)
**Root cause:** mrb_str_concat casts an mrb_value self to RString* without validating it is a string; a malformed heredoc/string expression yields a non-string value (0x1), so check_frozen dereferences an invalid pointer.
**Steps:**
1. Run the sandbox binary against the crafted script: `bin/sandbox /tmp/mrb_str_modify.min.rb`
2. Script uses nested heredocs and `qqq.("",<<000,"",...)` plus `0[<<0000,...]` to produce a non-string self
3. mrb_str_concat is invoked with self=0x1, casts to RString*, calls mrb_str_modify
4. check_frozen reads RSTR_FROZEN_P(s) at address 0x1 -> SIGSEGV
**How found:** Fuzzing/experimenting with mruby heredoc and string-concat edge cases in the sandbox; observed SIGSEGV and used gdb to trace the invalid RString pointer (0x1) into check_frozen.
**Exploitation:** Attacker submits a crafted Ruby script to the sandboxed eval service; the interpreter crashes the worker thread, denying service. No memory control demonstrated.
**Insight:** Odd heredoc/string-literal combinations can make the VM pass a non-string mrb_value as self to string methods; watch for missing type checks in C functions that cast mrb_value to RString* before dereferencing.