# SIGABRT - in free

mruby hash with mutable array key mutated after insertion corrupts heap; h.dup then frees a non-malloc'd pointer, causing SIGABRT/ASAN free-not-malloced.

- Payout: hidden
- Severity: high
- Program: Shopify
- Found by: ston3
- Disclosed: 2017-05-13
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/216725
- Library page: https://bugbountylibrary.com/r/h1%3A216725
- Tags: area:oss domain:oss impact:dos kind:bounty platform:hackerone sev:high tech:ruby vuln:dos vuln:memory-corruption

**Target:** mruby interpreter (mirb) hash/array internals
**Root cause:** A hash key containing a mutable array is mutated after insertion, so the stored key's hash/identity diverges; h.dup then mishandles the key, and GC frees a pointer that was not malloc'd (interior/stack pointer).
**Steps:**
1. Build mruby mirb with ASAN.
2. Run `mirb free.rb` with the PoC: create `a=[]`, hash `h={""=>0}`, insert `h[[a,"<long string>"]]=0`, mutate `a[0]="z"`, re-insert same key, then call `h.dup`.
3. Observe `malloc(): memory corruption` SIGABRT under gdb, or ASAN `attempting free on address which was not malloc()-ed` in `obj_free`/`free_heap` during `mrb_close`.
**How found:** Fuzzing/experimentation with mutable hash keys: mutating an array used as a hash key after insertion, then dup'ing the hash, surfaced heap corruption.
**Exploitation:** Not weaponized; crash/DoS demonstrated only. ASAN shows free of a non-malloc'd 14-byte region during GC teardown.
**Insight:** In interpreters, mutable objects used as hash keys break hash invariants; try mutating an array/string key after insertion and then dup/clone the hash to expose GC double-free or free-of-interior-pointer bugs.