# Interger overflow in str_substr leading to read/write out of bound memory

Integer overflow in mruby's str_substr bounds check lets a crafted String slice read/write out-of-bounds memory, crashing the interpreter and potentially enabling RCE.

- Payout: $100
- Severity: high
- Program: shopify-scripts
- Credited: beyondchain
- Disclosed: 2017-03-15
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/205884
- Library page: https://bugbountylibrary.com/r/h1%3A205884
- Tags: domain:oss impact:dos impact:rce kind:bounty platform:hackerone sev:high tech:ruby technique:source-review vuln:dos vuln:memory-corruption

**Target:** mruby String#[] / str_substr in string.c
**Root cause:** The check `if (beg + len > clen)` overflows when beg and len are large signed integers, so the clamp `len = clen - beg` is skipped and str_subseq is called with an out-of-range length.
**Steps:**
1. Run in mruby: `$b="B"*2048`
2. `$expand=$b[0x40,0x7fffffff]`
3. `puts $expand.size()` then `puts $expand`
4. Observe crash: beg=0x40, len=0x7fffffff, clen=0x800, beg+len wraps negative so bounds check passes
**How found:** Code review of str_substr bounds check; noticed beg+len signed addition could overflow, then crafted a slice with len=0x7fffffff to confirm the clamp is bypassed and crash the interpreter.
**Exploitation:** Attacker-controlled beg/len to String#[] triggers out-of-bounds read/write in str_subseq; demonstrated as interpreter crash, with potential for memory corruption or RCE.
**Insight:** When auditing length/bounds checks, target signed integer addition of two attacker-controlled values (beg+len) rather than subtraction; pick len near INT_MAX so the sum wraps negative and defeats the `> clen` guard.