# Crash: Initialize Decimal with itself triggers an assertion

Initializing a Decimal with itself in mruby-mpdecimal creates an empty mpd_t, and to_s on it trips an assertion, crashing the interpreter.

- Payout: $10,000
- Severity: high
- Program: shopify-scripts
- Found by: brakhane
- Disclosed: 2016-12-16
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/185775
- Library page: https://bugbountylibrary.com/r/h1%3A185775
- Tags: area:oss domain:oss impact:dos kind:bounty platform:hackerone sev:high tech:ruby technique:source-review vuln:dos

**Target:** mruby-mpdecimal Decimal extension in mruby engine
**Root cause:** When Decimal is initialized with itself, a new empty mpd_t is created; filling it calls to_s on the current instance, which accesses the empty mpd_t and hits an assertion in mpd_msword.
**Steps:**
1. Create an empty Decimal: `a = Decimal.new`
2. Re-initialize it with itself: `a.initialize a`
3. The initialize path calls to_s on the empty mpd_t, triggering `__assert_fail` in mpd_msword and aborting the process
**How found:** Reasoned about the initialize path: initializing a Decimal with itself creates an empty mpd_t, and the code then calls to_s on the same instance to fill it, accessing uninitialized state.
**Exploitation:** Attacker submits the two-line script to the mruby execution environment, causing SIGABRT and crashing the interpreter process.
**Insight:** In native-backed numeric types, test self-referential initialization (obj.initialize obj) — the copy path may read a freshly allocated empty backing struct before it is populated.

## Proof of concept (copied exactly from the original report)

**Ruby PoC initializing Decimal with itself**

```
a = Decimal.new
a.initialize a
```