# Null target_class DoS

instance_exec on an object without a creatable singleton class leaves VM target_class NULL, so defining a class inside the block null-derefs and segfaults mruby.

- Payout: $8,000
- Severity: high
- Program: shopify-scripts
- Credited: h72
- Disclosed: 2016-12-17
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/183405
- Library page: https://bugbountylibrary.com/r/h1%3A183405
- Tags: domain:oss impact:dos kind:bounty platform:hackerone sev:high tech:ruby technique:source-review vuln:dos vuln:memory-corruption

**Target:** mruby VM (mrbgems/mruby-object-ext Object#instance_exec)
**Root cause:** instance_exec sets VM target_class to the object's singleton class, but sets it to NULL when a singleton class cannot be created; OP_CLASS/OP_MODULE assume target_class is non-null and dereference it.
**Steps:**
1. Run `1.instance_exec { class X; end }` in the mruby VM
2. instance_exec attempts to create a singleton class for Integer 1, which fails, setting target_class to NULL
3. OP_CLASS executes inside the block and dereferences NULL target_class
4. VM segfaults
**How found:** Code review of instance_exec in object.c noting the NULL target_class fallback, then cross-referencing OP_CLASS/OP_MODULE opcodes that assume non-null target_class.
**Exploitation:** Attacker submits script code that calls instance_exec on an object lacking a singleton class (e.g. Integer) and defines a class/module inside the block, crashing the mruby VM (DoS).
**Insight:** When a VM sets a global 'current definition target' pointer, audit every path that can leave it NULL and every opcode that consumes it without a null check; instance_exec on immediates (Integer/Symbol) is a reliable way to force the NULL state.