# Invalid memory access in `mrb_str_format`

Positional width arg of 0 in mruby sprintf triggers negative-size memset, causing invalid memory access/crash in mrb_str_format.

- Payout: $100
- Severity: none
- Program: shopify-scripts
- Credited: haquaman
- Disclosed: 2017-01-11
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/191328
- Library page: https://bugbountylibrary.com/r/h1%3A191328
- Tags: domain:oss impact:dos kind:bounty platform:hackerone tech:ruby vuln:dos vuln:memory-corruption

**Target:** mruby sprintf (mrb_str_format)
**Root cause:** FWIDTH flag set before GETASTER consumes the width argument, so width=0 with positional '*' leads to FILL(' ', width-1) computing a negative size passed to memset.
**Steps:**
1. Run `mruby` with script containing `sprintf("%1$*c", 0)`
2. Observe crash EXC_BAD_ACCESS in _platform_bzero via mrb_str_format sprintf.c:693
3. Inspect width=0 and FILL(' ', width-1) producing negative length
**How found:** Fuzzing/crash triage of mruby sprintf with positional width specifier and zero argument; debugger backtrace pinpointed FILL with width-1.
**Insight:** Positional '*' width specifiers combined with zero/negative values are a rich source of integer-underflow in printf-family reimplementations; test `%N$*c` with 0.