# Buffer overflow in yywarning_s

Unbounded strcat in mruby's yywarning_s overflows a 256-byte stack buffer via a long parser warning string, crashing the process and potentially enabling stack smashing.

- Payout: $1,000
- Severity: high
- Program: shopify-scripts
- Credited: dgaletic
- Disclosed: 2019-09-04
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/535827
- Library page: https://bugbountylibrary.com/r/h1%3A535827
- Tags: domain:oss impact:dos kind:bounty platform:hackerone sev:high tech:ruby technique:fuzzing technique:source-review vuln:dos vuln:memory-corruption

**Target:** mruby compiler parser (yywarning_s in parse.y)
**Root cause:** yywarning_s copies msg and s into a fixed 256-byte stack buffer with strcpy/strcat without checking combined length, causing a stack buffer overflow.
**Steps:**
1. Feed the crafted long numeric string `300000000000000000000000000000000000000000000000E0030000...` to the mruby parser to trigger a warning with an oversized string.
2. Observe crash from stack buffer overflow in yywarning_s.
3. Apply patch adding strlen bounds check before strcat.
**How found:** Following prior reports of problematic string concatenation, the researchers audited similar strcat usage and found yywarning_s lacked a length check.
**Exploitation:** Attacker supplies a crafted script to mruby causing a parser warning whose message exceeds 256 bytes, overflowing the stack buffer; demonstrated as a crash, with probable control-flow hijack via stack smashing.
**Insight:** Parser warning/error formatting paths that concatenate user-controlled tokens into fixed stack buffers are a recurring overflow class; fuzz long literals that trigger diagnostics, not just valid parses.