mrb_ary_splice still has integer overflows

[clayton-shopify]

@matz @ksss

Even after #3409 there are still integer overflows in mrb_ary_splice, as the following input demonstrates:

a = [0] * 0x40000001
a[0x40000000,0x40000000] = [1]

This crashes because head + len overflows here:

mruby/src/array.c

Line 607 in 28cf7a5

if (a->len < len || a->len < head + len) {

and also here:

mruby/src/array.c

Line 650 in 28cf7a5

value_move(a->ptr + head + argc, a->ptr + head + len, a->len - (head + len));

[clayton-shopify]

I don't think the fix is quite right, but I couldn't find a way to exploit it. Comments are in the commit.

[matz]

b0f918d addressed the concern.

[ksss]

Thank you for reporting and fixing!