# SIGSEGV on mruby mrb_get_args()

Crafted mruby script passes an invalid RArray to mrb_get_args(), causing an invalid memory read and SIGSEGV that crashes the Shopify sandbox service.

- Payout: hidden
- Severity: low
- Program: Shopify
- Found by: ston3
- Disclosed: 2017-02-10
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/191938
- Library page: https://bugbountylibrary.com/r/h1%3A191938
- Tags: area:oss domain:oss impact:dos kind:bounty platform:hackerone sev:low tech:ruby technique:fuzzing vuln:dos vuln:memory-corruption

**Target:** mruby sandbox eval (mrb_get_args in class.c)
**Root cause:** mrb_get_args() dereferences mrb->c->stack[1] as an RArray without validating it is actually an array, so a->len reads attacker-controlled invalid memory.
**Steps:**
1. Run the sandbox binary against a script containing `l [],y(0,0,0,0,...)` with many zero args
2. The call reaches mrb_bob_missing -> mrb_get_args with format "n*" and argc<0
3. mrb_get_args treats stack[1] as RArray and reads a->len at class.c:523
4. Invalid pointer dereference triggers SIGSEGV, crashing the sandbox process
**How found:** Fuzzing/experimenting with mruby argument handling; noticed mrb_get_args assumes stack[1] is an RArray when argc<0 and crafted a call with an invalid array to hit the unchecked dereference.
**Exploitation:** Submit a crafted mruby script to the sandbox service; the malformed call crashes the interpreter thread, denying service to the sandbox.
**Insight:** In embedded interpreters, the argc<0 'array argv' path trusts the stack slot to be a real RArray; try passing non-array or malformed values to C-implemented methods that use mrb_get_args with '*' formats.