shopify-scripts · Report #182274
Null pointer dereference due to TOCTTOU bug in mrb_time_initialize
Validstatus
highseverity
15upvotes
15 Jan 2017disclosed
How it was found
mrb_time_initialize sets the data pointer to NULL before parsing function arguments. Parsing function arguments can call out to ruby code to call methods to do type coercion. If the type coercion method tries to access the time object it will dereference a NULL pointer.
The following snippet results in a native crash under mruby-engine:
$x = Time.new
class Tmp
def to_i
$x.mday
end
end
$x.initialize Tmp.new
Attached is a patch to mruby to fix this issue.