# heap-use-after-free in OP_RESCUE

Crafted mruby script with nested ensure/rescue and Class.new blocks triggers heap-use-after-free in OP_RESCUE, crashing mruby and mirb.

- Payout: $800
- Severity: medium
- Program: shopify-scripts
- Credited: ahihi
- Disclosed: 2018-01-17
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/295276
- Library page: https://bugbountylibrary.com/r/h1%3A295276
- Tags: domain:oss impact:dos kind:bounty platform:hackerone sev:medium tech:ruby technique:fuzzing vuln:dos vuln:memory-corruption

**Target:** mruby VM (OP_RESCUE / stack_extend in vm.c)
**Root cause:** During OP_RESCUE handling, a nested Class.new block causes stack_extend to realloc the VM stack while a pointer into the old stack region is still used, leading to a write-after-free in mrb_vm_exec.
**Steps:**
1. Build mruby with ASAN
2. Save the provided Ruby snippet to `out.rb`
3. Run `./mruby/bin/mruby out.rb`
4. Observe ASAN heap-use-after-free WRITE in mrb_vm_exec vm.c:1292, freed via stack_extend_alloc vm.c:186
**How found:** Likely fuzzing/grammar-based generation of nested ensure/rescue with Class.new blocks; the crash surfaced as ASAN UAF in OP_RESCUE.
**Insight:** Nested block-yielding constructs (Class.new with blocks) inside ensure/rescue can reallocate the VM stack mid-opcode; target interpreter opcodes that hold stack pointers across calls that may grow the stack.