# Invalid memory write caused by incorrect upper bound in array_copy

Integer overflow in mruby's ARY_MAX_SIZE bound let `*test*= results <<=value` trigger an oversized array allocation, causing an out-of-bounds write and segfault in array_copy.

- Payout: $1,000
- Severity: low
- Program: shopify-scripts
- Credited: haquaman
- Disclosed: 2016-12-18
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/185899
- Library page: https://bugbountylibrary.com/r/h1%3A185899
- Tags: domain:oss impact:dos kind:bounty platform:hackerone sev:low tech:ruby technique:source-review vuln:dos vuln:memory-corruption

**Target:** mruby interpreter array allocation (mrb_ary_times / array_copy)
**Root cause:** ARY_MAX_SIZE uses MRB_INT_MAX without dividing by sizeof(mrb_value), so the capacity check permits a length whose byte size overflows the allocation, and array_copy writes past the buffer.
**Steps:**
1. Write crash.rb with `values=[3,5,8]; test=[1,6]; results,=[1.2]` and a case/when using `when *test*= results <<=value`
2. Run `./dev/bin/mruby crash.rb`
3. Observe segfault in array_copy called from mrb_ary_times
4. Inspect ARY_MAX_SIZE macro: MRB_INT_MAX not divided by sizeof(mrb_value)
5. Apply patch dividing MRB_INT_MAX by sizeof(mrb_value); crash becomes `array size too big (ArgumentError)`
**How found:** Fuzzing/experimenting with odd splat-assignment syntax produced a segfault; debugger showed write within claimed allocation, leading to suspicion of realloc failure and then to the ARY_MAX_SIZE macro bound mismatch.
**Exploitation:** Local DoS: crafted Ruby script crashes the mruby interpreter via out-of-bounds write; not remotely weaponized in the report.
**Insight:** When a size check mixes element counts and byte counts, compare the two branches of the max macro for unit consistency; splat/assignment edge syntax is a good trigger for array-growth paths.