Null target_class DoS

Disclosed: 2016-12-17 01:02:59 By h72 To shopify-scripts
High
Vulnerability Details
The `Object#instance_exec` method in `mrbgems/mruby-object-ext/src/object.c` executes a block in the context of an object. It sets the VM's `target_class` pointer to the singleton class of this object. `target_class` is used as the definition target for constants and methods. If a singleton class cannot be created for an object, `target_class` is set to `NULL`. The `OP_CLASS` and `OP_MODULE` opcodes in the VM assume `target_class` is not null when defining new classes and modules. This causes a null pointer dereference and segfaults the mruby VM. Sample code: ``` 1.instance_exec { class X; end } ```
Actions
View on HackerOne
Report Stats
  • Report ID: 183405
  • State: Closed
  • Substate: resolved
  • Upvotes: 13
Share this report