# Integer Overflow in mrb_ary_set

Integer overflow in mruby's mrb_ary_set when assigning to index 0x7fffffff causes ary_expand_capa to under-allocate, then ary_fill_with_nil writes past the buffer and crashes.

- Payout: $100
- Severity: medium
- Program: shopify-scripts
- Credited: tunz
- Disclosed: 2017-01-12
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/192235
- Library page: https://bugbountylibrary.com/r/h1%3A192235
- Tags: domain:oss impact:dos kind:bounty platform:hackerone sev:medium tech:ruby technique:source-review vuln:dos vuln:memory-corruption

**Target:** mruby array setter (mrb_ary_set / ary_expand_capa)
**Root cause:** In mrb_ary_set, `n + 1` overflows when n == MRB_INT_MAX (0x7fffffff on 32-bit mrb_int), so ary_expand_capa allocates a tiny buffer while ary_fill_with_nil is asked to fill ~2^31 entries, writing out of bounds.
**Steps:**
1. Build mruby with 32-bit MRB_INT
2. Run `ary = Array.new(0); ary[0x7fffffff] = 1`
3. Observe SIGSEGV in ary_fill_with_nil writing past the undersized allocation
**How found:** Researcher read mrb_ary_set source and suspected `n + 1` could overflow at MRB_INT_MAX, then confirmed with a one-line PoC under gdb.
**Insight:** When auditing array/vector setters, check the capacity-expansion arithmetic for signed overflow at the max index value; a single `n+1` at INT_MAX turns a bounds check into an undersized allocation followed by a huge fill loop.