# Use-after-free leading to an invalid pointer dereference

Crafted mruby class with to_str/ensure/rescue triggers use-after-free in vm.c, letting attacker control callinfo struct and crash or potentially hijack execution.

- Payout: $800
- Severity: low
- Program: shopify-scripts
- Credited: dgaletic
- Disclosed: 2017-04-02
- Write-up quality: 8/10
- Original: https://hackerone.com/reports/213261
- Library page: https://bugbountylibrary.com/r/h1%3A213261
- Tags: domain:oss impact:dos impact:rce kind:bounty platform:hackerone sev:low tech:ruby technique:fuzzing technique:source-review vuln:dos vuln:memory-corruption

**Target:** mruby interpreter (vm.c, class.h) in Shopify Scripts sandbox
**Root cause:** A realloc during exception/rescue handling frees the callinfo/proc backing memory while vm.c still dereferences ci->proc->body.irep, yielding a dangling pointer (use-after-free).
**Steps:**
1. Define `class A < def to_str` with body invoking `""[1,2,3]`, `ensure --> {} rescue`, and `Struct.new.new.to_h`.
2. Trigger to_str conversion so the ensure/rescue path reallocs the callinfo stack.
3. Observe SIGSEGV at vm.c:1692 dereferencing ci->proc (e.g. 0x511).
4. Heap-spray with a long patterned string to overwrite the freed callinfo struct and control proc/stackent fields.
**How found:** Fuzzing/experimenting with unusual Ruby constructs (to_str + ensure + rescue + Struct) surfaced a crash; gdb and Valgrind confirmed invalid reads/writes in realloc-freed memory, prompting heap-spray attempts to control the callinfo struct.
**Exploitation:** Heap grooming via a large repeated string overwrites the freed callinfo struct; gdb shows proc=0xf0f0f0f0f0f0f0f and other fields attacker-controlled, demonstrating control over callinfo in mruby (mruby-engine not yet achieved).
**Insight:** Exception/ensure/rescue paths that realloc interpreter stacks are prime UAF territory; combine to_str coercion with ensure blocks to force reallocation mid-dereference, then heap-spray to control the freed callinfo.