# SIGSEGV - kh_get_n2s - in /src/symbol.c:37

Crafted nested singleton-class Ruby code causes mrb_class_path to recurse infinitely in mruby, overflowing the stack and crashing the interpreter (DoS).

- Payout: hidden
- Severity: low
- Program: Shopify
- Found by: mia_
- Disclosed: 2017-04-27
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/212456
- Library page: https://bugbountylibrary.com/r/h1%3A212456
- Tags: area:oss domain:oss impact:dos kind:bounty platform:hackerone sev:low tech:ruby technique:fuzzing vuln:dos vuln:memory-corruption

**Target:** mruby interpreter (src/class.c mrb_class_path / src/symbol.c)
**Root cause:** mrb_class_path recurses into mrb_class_path(outer) without a cycle/depth guard; a class whose outer module chain loops back on itself makes the recursion unbounded until the stack is exhausted.
**Steps:**
1. Feed the interpreter a script defining mutually-referential singleton classes: `class<<Proc` / `class P class<<Proc` / `class P class P t end end` / `end end end`
2. Interpreter calls mrb_class_path on the class, which calls mrb_class_outer_module and recurses into mrb_class_path(outer)
3. Recursion never terminates (backtrace shows repeated mrb_class_path frames), stack bottom reached
4. SIGSEGV in kh_get_n2s at src/symbol.c:37
**How found:** Fuzzing mruby with ASAN; a minimized nested singleton-class input produced a SIGSEGV, and the backtrace revealed unbounded recursion in mrb_class_path.
**Exploitation:** Attacker supplies the crafted Ruby source to an mruby-based service; the interpreter crashes on class-path resolution, denying service. No memory corruption or code execution demonstrated.
**Insight:** Class-name/path resolution that walks outer-module chains needs cycle detection; singleton-class redefinition (`class<<X`) can create self-referential outer chains that turn path lookups into unbounded recursion.