# mruby-time: Crash host with uninitialized Time obj

mruby-time's initialize_copy dereferences uninitialized Time object DATA_PTR, causing NULL-pointer segfault that crashes the mruby sandbox host.

- Payout: $8,000
- Severity: high
- Program: shopify-scripts
- Credited: brakhane
- Disclosed: 2016-12-16
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/184661
- Library page: https://bugbountylibrary.com/r/h1%3A184661
- Tags: domain:web3 impact:dos kind:bounty platform:hackerone sev:high tech:ruby technique:source-review vuln:dos vuln:memory-corruption

**Target:** mruby-time extension in Shopify mruby-engine sandbox
**Root cause:** mrb_time_initialize_copy copies *(struct mrb_time*)DATA_PTR(src) without checking that the Time object was ever initialized, so DATA_PTR is NULL and the dereference segfaults.
**Steps:**
1. Define `class Time; def initialize; end; end` to override initialize so Time.new never sets DATA_PTR
2. Create two objects: `a = Time.new; b = Time.new`
3. Call `a.initialize_copy b`
4. Observe SIGSEGV at time.c:533 in mrb_time_initialize_copy
**How found:** Researcher reviewed mruby-time source, noticed initialize_copy unconditionally dereferences DATA_PTR, and hypothesized overriding initialize would leave it NULL; confirmed via sandbox crash and gdb backtrace.
**Exploitation:** Submit the script to the mruby sandbox eval endpoint; the uninitialized Time object causes a NULL dereference in native code, crashing the host process running the sandbox.
**Insight:** In embedded interpreters, overriding a class's initialize in user script can leave native struct pointers NULL; audit C extension copy/dup methods for missing DATA_PTR null checks.