# SIGABRT, SIGSEGV mspace_free() and mrb_default_allocf()

mruby prepend of method_missing onto itself causes use-after-free/memory corruption in mrb_str_inspect, crashing mirb and the Ruby sandbox (DoS).

- Payout: hidden
- Severity: medium
- Program: Shopify
- Found by: ston3
- Disclosed: 2017-03-01
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/192532
- Library page: https://bugbountylibrary.com/r/h1%3A192532
- Tags: area:oss domain:oss impact:dos kind:bounty platform:hackerone sev:medium tech:ruby technique:source-review vuln:dos vuln:memory-corruption

**Target:** mruby interpreter / mirb REPL and mruby-engine Ruby sandbox
**Root cause:** Prepending a module whose method_missing is invoked onto itself via instance_eval causes a use-after-free in string buffer handling (mrb_str_inspect -> mrb_str_cat -> resize_capa -> mrb_realloc), corrupting heap metadata.
**Steps:**
1. Define `def method_missing(m)"0000000"end`
2. `m0=w.instance_eval{prepend(m)}`
3. `m0.instance_eval{prepend(m0)}`
4. Run in mirb: `mirb use_after_free` -> glibc `free(): invalid next size` SIGABRT
5. Larger string variant yields `malloc(): memory corruption`; in mruby-engine sandbox, SIGSEGV in mspace_free with registers filled with 0x3131...
**How found:** Researcher experimented with prepend/instance_eval and method_missing self-reference, observing heap corruption in gdb backtraces through mrb_str_inspect.
**Exploitation:** Attacker-supplied Ruby script executed in the mruby-engine sandbox crashes the host Ruby process (SIGSEGV/SIGABRT), killing the whole thread.
**Insight:** Self-referential prepend of a module onto its own instance via instance_eval is a fruitful fuzzing primitive for interpreter GC/string-buffer bugs; watch mrb_str_inspect realloc paths.