# A crash when an exception is caught in a caller and the receiver returned from `ensure`

Crafted Ruby snippet with a proc return inside ensure during exception unwinding segfaults mruby-engine's sandbox, crashing the interpreter.

- Payout: hidden
- Severity: medium
- Program: Shopify
- Found by: ahmadsherif
- Disclosed: 2017-02-28
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/204774
- Library page: https://bugbountylibrary.com/r/h1%3A204774
- Tags: area:oss domain:oss impact:dos kind:bounty platform:hackerone sev:medium tech:ruby technique:source-review vuln:dos vuln:memory-corruption

**Target:** mruby-engine sandbox (mruby interpreter embedded in Ruby)
**Root cause:** A non-local return from a proc invoked inside an ensure block while an exception is propagating corrupts the VM stack; mruby later dereferences a bogus value in mrb_respond_to during mrb_name_error formatting, causing a segfault.
**Steps:**
1. Run the provided Ruby snippet under `./bin/sandbox`.
2. Class A#foo defines `pr = proc { return 1 }`, calls undefined `does_not_exist` inside begin, and invokes `pr[]` in the ensure block.
3. Call `A.new.foo` wrapped in a rescue.
4. Observe `[BUG] Segmentation fault` with backtrace through mrb_respond_to / mrb_check_convert_type / join_ary / mrb_name_error.
**How found:** Researcher fuzzed/experimented with control-flow edge cases (non-local return from proc in ensure during exception unwinding) and observed the interpreter crash.
**Insight:** Sandboxed interpreter embeddings are attack surface: unusual control-flow combinations (return-from-proc inside ensure while an exception unwinds) can corrupt VM state and crash the host process, so test these against any embedded mruby/scripting engine.