# Null pointer dereference in mark_context_stack

Malformed mruby class/to_str code triggers a null pointer dereference in mark_context_stack during GC, crashing mruby and mruby-engine.

- Payout: $800
- Severity: low
- Program: shopify-scripts
- Credited: dgaletic
- Disclosed: 2017-03-14
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/208526
- Library page: https://bugbountylibrary.com/r/h1%3A208526
- Tags: domain:oss impact:dos kind:bounty platform:hackerone sev:low tech:ruby vuln:dos vuln:memory-corruption

**Target:** mruby / mruby-engine interpreter GC
**Root cause:** GC mark phase dereferences a freed/nil RBasic pointer (tt == MRB_TT_FREE path) when scanning the context stack, because a malformed value with tt=7013872 and p=0x0 reaches mark_context_stack.
**Steps:**
1. Run the crafted snippet `class A < def to_str\n 0 and s@e--->{}\n rescue ""\n end\nend` in mruby or mruby-engine
2. Trigger GC while the malformed context stack entry is live
3. Observe segfault at gc.c:554 in mark_context_stack (mrb_basic_ptr(v) == 0x0)
**How found:** Fuzzing/experimentation with malformed Ruby syntax (invalid class inheritance with def, rescue, and operator soup) to find parser/VM edge cases that corrupt the context stack before GC.
**Exploitation:** Local crash/DoS of the interpreter via crafted script input; no remote exploitation described.
**Insight:** Malformed class-inheritance syntax combined with rescue and operator tokens can leave partially-initialized stack values that GC later dereferences; target the GC mark phase with syntactically broken but parseable constructs.