# Still heap overflow in mrb_ary_splice

Incomplete fix in mruby's mrb_ary_splice still allows a huge head index to trigger ary_fill_with_nil with an enormous size, causing heap overflow and SIGSEGV.

- Payout: $800
- Severity: high
- Program: shopify-scripts
- Credited: tunz
- Disclosed: 2017-02-07
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/197719
- Library page: https://bugbountylibrary.com/r/h1%3A197719
- Tags: domain:oss impact:dos kind:bounty platform:hackerone sev:high tech:ruby technique:incomplete-fix vuln:dos vuln:memory-corruption

**Target:** mruby Array#[]= / mrb_ary_splice
**Root cause:** The prior fix only validated array size, not the head value; a huge head passed to mrb_ary_splice causes ary_fill_with_nil to write far past the buffer.
**Steps:**
1. Build mruby with 64-bit mrb_int
2. Run `ary = Array.new(1024); ary[0x7ffffffffffffc00,1024] = Array.new(1024)`
3. Observe SIGSEGV in ary_fill_with_nil with size=9223372036854765361
**How found:** Researcher revisited the previous fix (#192362) and noticed it only checked array size, not the head value, then crafted a PoC with a huge head index to keep size constant while overflowing.
**Insight:** When auditing a patch for an integer/overflow bug, check every variable feeding the dangerous sink, not just the one the fix touched; here head was left unchecked while size was validated.