# Invalid pointer dereference in OP_ENTER

Crafted __send__ with many args and method_missing in mruby sandbox causes invalid pointer dereference in OP_ENTER, crashing the VM.

- Payout: $800
- Severity: low
- Program: shopify-scripts
- Credited: dgaletic
- Disclosed: 2017-04-15
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/218570
- Library page: https://bugbountylibrary.com/r/h1%3A218570
- Tags: domain:oss impact:dos kind:bounty platform:hackerone sev:low tech:ruby technique:fuzzing vuln:dos vuln:memory-corruption

**Target:** mruby VM OP_ENTER / sandbox
**Root cause:** When argc is negative in OP_ENTER, the VM reads regs[1] as an RArray and dereferences ary->ptr without validating it is a real array, yielding an invalid pointer.
**Steps:**
1. Define empty `method_missing`
2. Call `__send__ :f,0,0,...` with a very large number of arguments
3. VM enters OP_ENTER with argc<0 and dereferences regs[1] as RArray
4. Crash at vm.c:1573 accessing ary->ptr (0x4000002cb)
**How found:** Fuzzing/experimentation with argument counts to __send__ combined with method_missing, then gdb backtrace pinpointing OP_ENTER argc<0 path.
**Exploitation:** Attacker submits a script to the sandbox causing the mruby VM to crash, denying service to the interpreter.
**Insight:** Negative argc in OP_ENTER (from oversized splat/__send__ arg lists) is treated as an array pointer; probe VM opcodes with extreme argument counts to hit unchecked register assumptions.