# Crash: mrb_any_to_s can't handle NilClass, Symbol and Fixnum

Removing :to_s from NilClass/Symbol/Fixnum in mruby's boxing_word.h causes mrb_any_to_s to dereference a non-pointer immediate value, crashing the sandbox with SIGSEGV.

- Payout: $8,000
- Severity: high
- Program: shopify-scripts
- Credited: brakhane
- Disclosed: 2016-12-16
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/185794
- Library page: https://bugbountylibrary.com/r/h1%3A185794
- Tags: domain:oss impact:dos kind:bounty platform:hackerone sev:high tech:ruby technique:source-review vuln:dos vuln:memory-corruption

**Target:** mruby engine (mrb_any_to_s in object.c) under boxing_word.h
**Root cause:** mrb_any_to_s assumes obj is a heap pointer and calls mrb_cptr(obj)/mrb_ptr_to_str, but boxed immediates (nil, symbol, fixnum) are not pointers; when :to_s is removed the fallback path dereferences the immediate value as a pointer.
**Steps:**
1. Load mruby with boxing_word.h boxing scheme
2. Execute `NilClass.remove_method :to_s`
3. Execute `nil.to_s` (also works for Symbol and Fixnum)
4. Observe SIGSEGV in mrb_any_to_s at object.c:443 via mrb_str_concat/mrb_ptr_to_str
**How found:** Researcher reasoned that mrb_any_to_s is a generic fallback that must work for all object types; tested by deleting the :to_s method from immediate classes (NilClass, Symbol, Fixnum) to force the fallback path, then observed the crash under sandbox_extract and confirmed in GDB at object.c:443.
**Exploitation:** Attacker-supplied mruby script in the sandbox removes :to_s from an immediate class and calls to_s, triggering a NULL-ish pointer dereference (0x18) and crashing the monitored eval thread — a sandbox DoS.
**Insight:** In embedded interpreters, generic fallback methods (any_to_s, inspect, hash) often assume heap-object layout; forcing them via remove_method on immediate/boxed types (nil, symbols, fixnums) exposes type-confusion crashes — try removing core methods to reach fallback C paths.