shopify-scripts: SIGSEGV on mrb_vm_exec() Null Deref

Crash occurs when mrbvalue pool is passed null value. Sample --------------------- The following code triggers the bug attached as mrbvmexec.rb: Proc.removemethod:initialize Class.newdefinemethod:m definemethod:m0,Proc.new.new.m0 Crash --------------------- Attached as sandbox.log...

shopify-scripts: mrb_vformat() heap overflow could lead to code execution

Description: ==================== mrbvformat is responsible to parse string format like 'printf' in C, the code doesn't check the number given between '%' and '$' . mrbfixnumtostr is called by joinary and converts the given number from string into integer, this could lead to overwrite and fully...