# Invalid handling of zero-length heredoc identifiers leads to infinite loop in the sandbox

Zero-length heredoc identifier in MRuby parser makes strncmp match empty term, causing infinite loop that ignores SIGTERM in Shopify's sandbox.

- Payout: $10,000
- Severity: high
- Program: shopify-scripts
- Credited: dkasak
- Disclosed: 2017-01-12
- Write-up quality: 8/10
- Original: https://hackerone.com/reports/187305
- Library page: https://bugbountylibrary.com/r/h1%3A187305
- Tags: domain:oss impact:dos kind:bounty platform:hackerone sev:high tech:ruby technique:parser-differential technique:source-review vuln:dos

**Target:** MRuby parser (parse_string) in mruby-engine sandbox
**Root cause:** parse_string checks heredoc terminator with strncmp(s, hinf->term, len-1); when term_len is 0, strncmp returns 0 regardless of content, so an empty identifier falsely matches and emits tHEREDOC_END, which is invalid for parser state and loops back into parse_string.
**Steps:**
1. Save `<<''.a begin` as infinite_heredoc.rb
2. Run `mruby infinite_heredoc.rb` or `sandbox infinite_heredoc.rb`
3. Observe infinite loop; sandbox process ignores SIGTERM, requires SIGABRT/SIGKILL
4. Variant: `<<''.a do` triggers same loop
**How found:** Compared MRuby vs MRI parser behavior on invalid heredocs; noticed MRI errors on empty identifier while MRuby looped. Traced to parse_string's strncmp check and reasoned that len-1==0 makes strncmp always return 0, falsely matching the empty terminator.
**Exploitation:** Submit the malformed script to the mruby-engine sandbox; parser enters infinite loop, making the sandbox and host MRI process unresponsive to SIGTERM, requiring SIGKILL to recover.
**Insight:** When auditing parsers, test zero-length delimiters/identifiers: strncmp/memcmp with length 0 always matches, so terminator checks must guard term_len != 0. Differential-testing against a reference parser (MRI) surfaces these edge cases.