# Heap Overflow in fiber_switch triggered from Fiber.transfer

mruby's fiber_switch copies transfer arguments into a 64-slot fiber stack without bounds checking, allowing heap overflow via Fiber.transfer with 64+ args.

- Payout: hidden
- Severity: high
- Program: shopify-scripts
- Found by: avisaven
- Disclosed: 2017-05-30
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/227762
- Library page: https://bugbountylibrary.com/r/h1%3A227762
- Tags: area:oss domain:oss impact:dos kind:bounty platform:hackerone sev:high tech:ruby technique:source-review vuln:memory-corruption

**Target:** mruby fiber_switch in mruby-fiber mrbgem
**Root cause:** Fiber stack is initialized to FIBER_STACK_INIT_SIZE (64) slots, but fiber_switch copies all transfer arguments into c->stack+1 when status is MRB_FIBER_CREATED without checking len against the stack size.
**Steps:**
1. Create a Fiber: `Fiber.new{}`
2. Call `.transfer` with 64 or more arguments (e.g. 65 zeros)
3. fiber_switch copies len arguments into the 64-slot fiber stack, overflowing the heap
**How found:** Code review of mrbgems/mruby-fiber/src/fiber.c: noticed stack init size of 64 at lines 90-96 versus unbounded copy of transfer args at lines 191-198 when fiber status is MRB_FIBER_CREATED.
**Insight:** When a fixed-size buffer is initialized with a constant like FIBER_STACK_INIT_SIZE, grep for every write into that buffer and check whether the length parameter is validated against the same constant.