# Heap buffer overflow in mruby value_move

Fuzzed mruby script triggers heap buffer overflow in value_move during VM execution, writing 16 bytes past a 2048-byte heap allocation and crashing the interpreter.

- Payout: hidden
- Severity: medium
- Program: Shopify
- Found by: sukhoi
- Disclosed: 2017-04-13
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/209765
- Library page: https://bugbountylibrary.com/r/h1%3A209765
- Tags: area:oss domain:oss impact:dos kind:bounty platform:hackerone sev:medium tech:ruby technique:fuzzing technique:incomplete-fix technique:regression vuln:dos vuln:memory-corruption

**Target:** mruby bytecode VM (value_array.h value_move / vm.c mrb_vm_exec)
**Root cause:** value_move in src/value_array.h performs a memcpy of 16 bytes without bounds-checking the destination array, so a crafted script drives the VM to write past the end of a 2048-byte heap region. A prior fix (f198530) was reverted by commit 736be0e, reintroducing the bug.
**Steps:**
1. Build mruby master (commit 8b089c0) with ASAN.
2. Save the crafted script `d 0, 0, ... 0 < 0 - 0.-- 1` as testcase.rb.
3. Run `./mruby ./testcase.rb`.
4. ASAN reports heap-buffer-overflow WRITE of size 16 in value_move (value_array.h:14) called from mrb_vm_exec (vm.c:1200), 0 bytes right of a 2048-byte region.
**How found:** Fuzzing mruby; the researcher recognized the crash resembled prior report 204421 and traced that its fix commit f198530 was reverted by commit 736be0e, confirming the bug was live again on master.
**Insight:** When a fuzz crash resembles a previously fixed bug, check the fix commit's history for reverts — a reverted patch silently reopens the vulnerability on current master.