# Incorrect code generation when result of NODE_NEGATE is not used

Unused NODE_NEGATE result causes mruby codegen to recurse on an invalid node, letting crafted literals control filename_index and trigger an assert crash.

- Payout: $1,000
- Severity: low
- Program: shopify-scripts
- Credited: dkasak
- Disclosed: 2017-01-12
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/191689
- Library page: https://bugbountylibrary.com/r/h1%3A191689
- Tags: domain:oss impact:dos kind:bounty platform:hackerone sev:low tech:ruby technique:regression technique:source-review vuln:dos vuln:memory-corruption

**Target:** mruby compiler codegen (NODE_NEGATE handling)
**Root cause:** codegen recurses on the NODE_NEGATE argument without validating it is a valid node; the cdr is reinterpreted so filename_index becomes attacker-controlled.
**Steps:**
1. Craft input `-0E00;0` (or `-0.5555555555555555555;0`) where NODE_NEGATE result is unused
2. Run `mruby assert_failure.rb` or `sandbox assert_failure.rb`
3. Observe SIGABRT from `assert(irep->filename)` in debug.c:135
4. In gdb break at parse.y:2885 to see filename_index set to 13621 from '5' chars
**How found:** Code review of the commit d56a19cbf526190de036130fe3a5bf14a0705ee2 introducing NODE_NEGATE; noticed codegen called recursively without node validity check, then used gdb to confirm filename_index control.
**Exploitation:** Attacker supplies a script with an unused negated numeric literal; the compiler misinterprets node memory, setting filename_index to attacker-influenced values, causing an assertion failure and process abort (DoS).
**Insight:** When a compiler pass recurses on AST children, audit paths where a node's result is discarded (NOVAL) — those branches often skip type validation and let raw cdr bytes leak into metadata fields like filename_index.