# Double free of filename after codegen error

Deeply nested assignment expression triggers codegen 'too complex expression' error, causing double free of nested irep->filename in mruby compiler.

- Payout: $200
- Severity: low
- Program: shopify-scripts
- Credited: titanous
- Disclosed: 2017-02-07
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/193719
- Library page: https://bugbountylibrary.com/r/h1%3A193719
- Tags: domain:oss impact:dos kind:bounty platform:hackerone sev:low tech:ruby technique:source-review vuln:dos vuln:memory-corruption

**Target:** mruby compiler codegen (mrb_generate_code / mrb_irep_free)
**Root cause:** MRB_CATCH in mrb_generate_code nulls scope->irep->filename only for the top irep, but nested ireps share the filename pointer; mrb_irep_free frees it unconditionally, so nested irep frees a pointer it doesn't own.
**Steps:**
1. Craft Ruby source with deeply nested `a>>=a>>=...` inside nested defs to exceed codegen complexity limit
2. Run through mruby-engine sandbox / mruby binary
3. Codegen raises 'too complex expression', MRB_CATCH decrefs irep chain
4. Nested irep's filename (shared pointer) is freed twice -> ASAN double-free
**How found:** Fuzzing/experimenting with pathological nested assignment expressions to trigger codegen error paths, then reading MRB_CATCH cleanup logic and noticing nested ireps share filename pointer.
**Exploitation:** Not exploitable per reporter: second free occurs near program end, no heap overflow or useful heap control observed.
**Insight:** Error-handling cleanup paths that null a shared pointer only at the top level miss nested structures aliasing the same allocation; audit decref/free chains for ownership flags rather than pointer-equality nulling.