# segafult in mruby's sprintf - mrb_str_format

Hostile sprintf width value overflows the CHECK() capacity macro in mruby's mrb_str_format, causing a SIGSEGV crash of mirb.

- Payout: hidden
- Severity: medium
- Program: Shopify
- Found by: aerodudrizzt
- Disclosed: 2017-02-28
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/204628
- Library page: https://bugbountylibrary.com/r/h1%3A204628
- Tags: area:oss domain:oss impact:dos kind:bounty platform:hackerone sev:medium tech:ruby technique:source-review vuln:dos vuln:memory-corruption

**Target:** mruby sprintf gem / mrb_str_format()
**Root cause:** CHECK(l) computes blen + l where l is an attacker-controlled width up to MAX_INT, overflowing the size comparison so the buffer is not grown enough before writing.
**Steps:**
1. Run mirb from the mruby build.
2. Execute `sprintf("abcdefghijklmnopqrstuvwxyz % 2147483640s", s)` with `s = "hello"`.
3. Observe SIGSEGV in mrb_str_format due to integer overflow in CHECK().
**How found:** Code review of sprintf.c's CHECK() macro, noticing blen + l arithmetic on an unbounded width parameter.
**Exploitation:** A single sprintf call with a huge width value triggers the overflow and crashes the interpreter process (DoS).
**Insight:** When auditing format-string implementations, check capacity macros that add an attacker-controlled width to a length; rewrite as subtraction against remaining space to avoid overflow.