Heap buffer overflow in OP_SETUPVAR

[clayton-shopify]

The following input demonstrates a crash:

begin ensure
00end
begin()ensure
v=00end

A bisect shows that the crash began in e26e118, and it still happens on the latest master (3c10783).

ASAN report:

==86749==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200001f020 at pc 0x0001011ac4ca bp 0x7fff5f709bb0 sp 0x7fff5f709360
WRITE of size 16 at 0x60200001f020 thread T0
    #0 0x1011ac4c9 in __asan_memcpy (libclang_rt.asan_osx_dynamic.dylib:x86_64h+0x4d4c9)
    #1 0x100650f16 in mrb_vm_exec (mruby:x86_64+0x10016cf16)
    #2 0x10064b4ef in mrb_vm_run (mruby:x86_64+0x1001674ef)
    #3 0x10064343e in mrb_run (mruby:x86_64+0x10015f43e)
    #4 0x10067c5b7 in ecall (mruby:x86_64+0x1001985b7)
    #5 0x100653c50 in mrb_vm_exec (mruby:x86_64+0x10016fc50)
    #6 0x10064b4ef in mrb_vm_run (mruby:x86_64+0x1001674ef)
    #7 0x10067f169 in mrb_top_run (mruby:x86_64+0x10019b169)
    #8 0x100750bf5 in mrb_load_exec (mruby:x86_64+0x10026cbf5)
    #9 0x100751545 in mrb_load_file_cxt (mruby:x86_64+0x10026d545)
    #10 0x1004e6186 in main mruby.c:227
    #11 0x7fffbdf72234 in start (libdyld.dylib:x86_64+0x5234)

0x60200001f020 is located 0 bytes to the right of 16-byte region [0x60200001f010,0x60200001f020)
allocated by thread T0 here:
    #0 0x1011b5520 in wrap_realloc (libclang_rt.asan_osx_dynamic.dylib:x86_64h+0x56520)
    #1 0x1005df305 in mrb_default_allocf (mruby:x86_64+0x1000fb305)
    #2 0x10055fb18 in mrb_realloc_simple gc.c:203
    #3 0x10056026e in mrb_realloc gc.c:217
    #4 0x100560cf3 in mrb_malloc gc.c:238
    #5 0x10063cbec in mrb_env_unshare (mruby:x86_64+0x100158bec)
    #6 0x100641182 in cipop (mruby:x86_64+0x10015d182)
    #7 0x1006638d8 in mrb_vm_exec (mruby:x86_64+0x10017f8d8)
    #8 0x10064b4ef in mrb_vm_run (mruby:x86_64+0x1001674ef)
    #9 0x10064343e in mrb_run (mruby:x86_64+0x10015f43e)
    #10 0x10067c5b7 in ecall (mruby:x86_64+0x1001985b7)
    #11 0x100653c50 in mrb_vm_exec (mruby:x86_64+0x10016fc50)
    #12 0x10064b4ef in mrb_vm_run (mruby:x86_64+0x1001674ef)
    #13 0x10067f169 in mrb_top_run (mruby:x86_64+0x10019b169)
    #14 0x100750bf5 in mrb_load_exec (mruby:x86_64+0x10026cbf5)
    #15 0x100751545 in mrb_load_file_cxt (mruby:x86_64+0x10026d545)
    #16 0x1004e6186 in main mruby.c:227
    #17 0x7fffbdf72234 in start (libdyld.dylib:x86_64+0x5234)

SUMMARY: AddressSanitizer: heap-buffer-overflow (libclang_rt.asan_osx_dynamic.dylib:x86_64h+0x4d4c9) in __asan_memcpy
Shadow bytes around the buggy address:
  0x1c0400003db0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x1c0400003dc0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x1c0400003dd0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x1c0400003de0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x1c0400003df0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x1c0400003e00: fa fa 00 00[fa]fa 00 06 fa fa 00 04 fa fa 00 fa
  0x1c0400003e10: fa fa 00 00 fa fa 00 04 fa fa 00 06 fa fa 06 fa
  0x1c0400003e20: fa fa 00 fa fa fa 06 fa fa fa 00 04 fa fa 00 00
  0x1c0400003e30: fa fa fd fd fa fa 00 06 fa fa 04 fa fa fa 00 fa
  0x1c0400003e40: fa fa 04 fa fa fa 00 fa fa fa 00 00 fa fa fd fd
  0x1c0400003e50: fa fa 00 00 fa fa 00 fa fa fa fd fd fa fa fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==86749==ABORTING
Abort trap: 6

This issue was reported by https://hackerone.com/ston3