# Segfault when passing invalid values to `values_at`

Passing a primitive non-Fixnum like `true` to `values_at` on Array/Struct caused mruby to dereference an invalid pointer and segfault.

- Payout: $1,000
- Severity: low
- Program: shopify-scripts
- Credited: dkasak
- Disclosed: 2016-12-17
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/190133
- Library page: https://bugbountylibrary.com/r/h1%3A190133
- Tags: domain:oss impact:dos kind:bounty platform:hackerone sev:low tech:ruby technique:regression technique:source-review vuln:dos vuln:memory-corruption

**Target:** mruby Struct/Range values_at method
**Root cause:** `range_beg_len` called `mrb_range_ptr` on the argument before checking `mrb_type(range) == MRB_TT_RANGE`, dereferencing a pointer derived from a primitive mrb_value.
**Steps:**
1. Run `mruby crash.rb` with `[].values_at true`
2. Or `Struct.new.new.values_at true`
3. Observe segfault from invalid pointer dereference in `mrb_range_ptr`
**How found:** Traced crash to commit 79a621dd introducing `mrb_range_ptr`; noticed type check in `range_beg_len` occurred after the pointer dereference.
**Insight:** When a new accessor helper dereferences a struct pointer, check that every caller validates the mrb_value type before calling it—ordering of type-check vs deref is the bug.