# Null pointer dereference in OP_ENTER

A crafted Ruby class hierarchy calling super with a block and splat args causes a null pointer dereference in mruby's OP_ENTER, crashing the VM.

- Payout: $800
- Severity: low
- Program: shopify-scripts
- Credited: dgaletic
- Disclosed: 2017-04-15
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/218233
- Library page: https://bugbountylibrary.com/r/h1%3A218233
- Tags: domain:oss impact:dos kind:bounty platform:hackerone sev:low tech:ruby vuln:dos vuln:memory-corruption

**Target:** mruby / mruby-engine VM (OP_ENTER opcode)
**Root cause:** In OP_ENTER, when argc < 0 the code dereferences regs[1] as an RArray without checking it is non-null; a super call with splat args plus a block leaves that register null.
**Steps:**
1. Define class A with method foo.
2. Define class B < A with foo(*args) that calls `super(*args, &:b)`.
3. Instantiate B and call `B.new.foo`.
4. Observe crash at vm.c:1572 dereferencing ary->ptr where ary is NULL.
**How found:** Fuzzing/edge-case exploration of mruby method dispatch: combining splat args with a block-pass in a super call to reach the argc<0 branch of OP_ENTER with an unset register.
**Insight:** In VM opcode handlers, the argc<0 (splat) path assumes the argument array register is populated; combining super + splat + block-pass can leave it null. Target argument-splatting opcodes with unusual call forms.