# Null pointer dereference in ary_concat 

Crafted mruby expression `[][*@a] = f &:s` triggers a null pointer dereference in ary_concat, crashing the mruby interpreter and Shopify's mruby-engine sandbox.

- Payout: $800
- Severity: low
- Program: shopify-scripts
- Credited: dgaletic
- Disclosed: 2017-04-15
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/214681
- Library page: https://bugbountylibrary.com/r/h1%3A214681
- Tags: domain:oss impact:dos kind:bounty platform:hackerone sev:low tech:ruby vuln:dos vuln:memory-corruption

**Target:** mruby interpreter / mruby-engine (array.c ary_concat)
**Root cause:** The multiple-assignment/splat path passes a NULL RArray as `a` to ary_concat, which dereferences a2->len and a->len without a null check.
**Steps:**
1. Define empty method `def f; end`
2. Evaluate `[][*@a] = f &:s`
3. Interpreter crashes at array.c:260 in ary_concat with a=0x0
4. Under mruby-engine, crash occurs at vm.c:1210 OP_SEND
**How found:** Fuzzing/experimentation with unusual multiple-assignment and splat syntax (`[*@a] =`) combined with a block-passing call, observing the interpreter crash and confirming via gdb backtrace that `a` was NULL.
**Exploitation:** Not weaponized beyond a crash; the PoC causes a denial-of-service crash of the mruby interpreter and the mruby-engine sandbox used by Shopify Scripts.
**Insight:** Odd assignment forms combining splat targets with block-argument calls (`f &:s`) can reach internal array-concat paths with uninitialized/NULL receivers; probe grammar edge cases in embedded interpreters.