# Heap Overflow in mrb_arb_splice

Integer overflow in mruby's mrb_ary_splice size calculation bypasses capacity expansion, causing heap overflow in ary_fill_with_nil when splicing at a huge index.

- Payout: $800
- Severity: low
- Program: shopify-scripts
- Credited: tunz
- Disclosed: 2017-01-12
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/192362
- Library page: https://bugbountylibrary.com/r/h1%3A192362
- Tags: domain:oss impact:dos kind:bounty platform:hackerone sev:low tech:ruby technique:source-review vuln:dos vuln:memory-corruption

**Target:** mruby array.c mrb_ary_splice / ary_fill_with_nil
**Root cause:** size = head + argc overflows mrb_int (64-bit), so the `size > a->aux.capa` check is bypassed and ary_expand_capa is not called; then ary_fill_with_nil writes head - a->len nils past the small allocation.
**Steps:**
1. Build mruby with MRB_INT64
2. Run `ary = Array.new(1023); ary[0x7ffffffffffffc00,0] = Array.new(1024)`
3. Observe SIGSEGV in ary_fill_with_nil writing to ptr past allocation
**How found:** Researcher noted similarity to prior report #192235 but different root cause; traced the crash backtrace into mrb_ary_splice and identified the `size = head + argc` signed overflow bypassing the capacity check before ary_fill_with_nil.
**Insight:** When auditing array/string splice or resize routines, check whether the computed new-size arithmetic can overflow the signed index type before the capacity comparison, letting a huge head index skip reallocation while a fill loop still writes head-len elements.