# Heap buffer overflow with long array assignment

mruby VM writes past its stack buffer when a long array literal is used as an assignment target, causing a heap buffer overflow in mrb_vm_exec.

- Payout: $800
- Severity: high
- Program: shopify-scripts
- Credited: titanous
- Disclosed: 2017-03-14
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/209449
- Library page: https://bugbountylibrary.com/r/h1%3A209449
- Tags: domain:oss impact:dos kind:bounty platform:hackerone sev:high tech:ruby technique:fuzzing vuln:dos vuln:memory-corruption

**Target:** mruby interpreter VM (mrb_vm_exec stack handling)
**Root cause:** The VM does not grow/validate its stack when a large array literal is used as an assignment target (`[...]-=0`), so the write at vm.c:1164 lands 8 bytes past the 2048-byte stack region.
**Steps:**
1. Build mruby with ASAN.
2. Run `[][]=%` then `[0,0,...(63 zeros)...]-=0` as a script.
3. Observe ASAN heap-buffer-overflow WRITE of size 4 in mrb_vm_exec at vm.c:1164, 8 bytes right of the 2048-byte stack region.
**How found:** Likely fuzzing/experimentation with unusual assignment-target syntax (array literal as LHS with compound assignment) in the mruby interpreter.
**Insight:** Interpreter stack sizing assumptions break when syntactically unusual LHS forms (array literals as assignment targets) push more values than the VM stack was sized for; try compound assignments on literal/collection LHS in embedded language runtimes.