Invalid read in array_copy and mrb_ary_unshift_m

[dkasak]

The following input causes an invalid read on latest master (c10e191):

*z = Array.new.cycle.to_s
z.prepend *(z.prepend (z.prepend (z.prepend)).count(""))

Valgrind report:

==561369== Memcheck, a memory error detector
==561369== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al.
==561369== Using Valgrind-3.15.0 and LibVEX; rerun with -h for copyright info
==561369== Command: mruby 17d4e0422f76f236c460d02fd0a34b6a55c3aafa
==561369== 
17d4e0422f76f236c460d02fd0a34b6a55c3aafa:2:11: warning: '*' interpreted as argument prefix
==561369== Invalid read of size 16
==561369==    at 0x12B958: array_copy (array.c:78)
==561369==    by 0x12B958: mrb_ary_unshift_m (array.c:640)
==561369==    by 0x12393D: mrb_vm_exec (vm.c:1444)
==561369==    by 0x128A43: mrb_vm_run (vm.c:947)
==561369==    by 0x14E44E: mrb_load_exec (parse.y:6339)
==561369==    by 0x10DC3E: main (mruby.c:270)
==561369==  Address 0x4ce5920 is 0 bytes inside a block of size 64 free'd
==561369==    at 0x483AD7B: realloc (vg_replace_malloc.c:836)
==561369==    by 0x131004: mrb_realloc_simple (gc.c:209)
==561369==    by 0x131004: mrb_realloc (gc.c:223)
==561369==    by 0x12A47F: ary_expand_capa (array.c:224)
==561369==    by 0x12BA5A: mrb_ary_unshift_m (array.c:636)
==561369==    by 0x12393D: mrb_vm_exec (vm.c:1444)
==561369==    by 0x128A43: mrb_vm_run (vm.c:947)
==561369==    by 0x14E44E: mrb_load_exec (parse.y:6339)
==561369==    by 0x10DC3E: main (mruby.c:270)
==561369==  Block was alloc'd at
==561369==    at 0x48386AF: malloc (vg_replace_malloc.c:308)
==561369==    by 0x483ADE7: realloc (vg_replace_malloc.c:836)
==561369==    by 0x131478: mrb_realloc_simple (gc.c:209)
==561369==    by 0x131478: mrb_realloc (gc.c:223)
==561369==    by 0x131478: mrb_malloc (gc.c:245)
==561369==    by 0x12A4AA: ary_expand_capa (array.c:215)
==561369==    by 0x12BA5A: mrb_ary_unshift_m (array.c:636)
==561369==    by 0x12393D: mrb_vm_exec (vm.c:1444)
==561369==    by 0x128A43: mrb_vm_run (vm.c:947)
==561369==    by 0x14E44E: mrb_load_exec (parse.y:6339)
==561369==    by 0x10DC3E: main (mruby.c:270)
==561369== 
==561369== Invalid read of size 16
==561369==    at 0x12B969: array_copy (array.c:77)
==561369==    by 0x12B969: mrb_ary_unshift_m (array.c:640)
==561369==    by 0x12393D: mrb_vm_exec (vm.c:1444)
==561369==    by 0x128A43: mrb_vm_run (vm.c:947)
==561369==    by 0x14E44E: mrb_load_exec (parse.y:6339)
==561369==    by 0x10DC3E: main (mruby.c:270)
==561369==  Address 0x4ce5940 is 32 bytes inside a block of size 64 free'd
==561369==    at 0x483AD7B: realloc (vg_replace_malloc.c:836)
==561369==    by 0x131004: mrb_realloc_simple (gc.c:209)
==561369==    by 0x131004: mrb_realloc (gc.c:223)
==561369==    by 0x12A47F: ary_expand_capa (array.c:224)
==561369==    by 0x12BA5A: mrb_ary_unshift_m (array.c:636)
==561369==    by 0x12393D: mrb_vm_exec (vm.c:1444)
==561369==    by 0x128A43: mrb_vm_run (vm.c:947)
==561369==    by 0x14E44E: mrb_load_exec (parse.y:6339)
==561369==    by 0x10DC3E: main (mruby.c:270)
==561369==  Block was alloc'd at
==561369==    at 0x48386AF: malloc (vg_replace_malloc.c:308)
==561369==    by 0x483ADE7: realloc (vg_replace_malloc.c:836)
==561369==    by 0x131478: mrb_realloc_simple (gc.c:209)
==561369==    by 0x131478: mrb_realloc (gc.c:223)
==561369==    by 0x131478: mrb_malloc (gc.c:245)
==561369==    by 0x12A4AA: ary_expand_capa (array.c:215)
==561369==    by 0x12BA5A: mrb_ary_unshift_m (array.c:636)
==561369==    by 0x12393D: mrb_vm_exec (vm.c:1444)
==561369==    by 0x128A43: mrb_vm_run (vm.c:947)
==561369==    by 0x14E44E: mrb_load_exec (parse.y:6339)
==561369==    by 0x10DC3E: main (mruby.c:270)
==561369== 
==561369== Invalid read of size 4
==561369==    at 0x12B9AB: mrb_ary_unshift_m (array.c:643)
==561369==    by 0x12393D: mrb_vm_exec (vm.c:1444)
==561369==    by 0x128A43: mrb_vm_run (vm.c:947)
==561369==    by 0x14E44E: mrb_load_exec (parse.y:6339)
==561369==    by 0x10DC3E: main (mruby.c:270)
==561369==  Address 0x4ce5948 is 40 bytes inside a block of size 64 free'd
==561369==    at 0x483AD7B: realloc (vg_replace_malloc.c:836)
==561369==    by 0x131004: mrb_realloc_simple (gc.c:209)
==561369==    by 0x131004: mrb_realloc (gc.c:223)
==561369==    by 0x12A47F: ary_expand_capa (array.c:224)
==561369==    by 0x12BA5A: mrb_ary_unshift_m (array.c:636)
==561369==    by 0x12393D: mrb_vm_exec (vm.c:1444)
==561369==    by 0x128A43: mrb_vm_run (vm.c:947)
==561369==    by 0x14E44E: mrb_load_exec (parse.y:6339)
==561369==    by 0x10DC3E: main (mruby.c:270)
==561369==  Block was alloc'd at
==561369==    at 0x48386AF: malloc (vg_replace_malloc.c:308)
==561369==    by 0x483ADE7: realloc (vg_replace_malloc.c:836)
==561369==    by 0x131478: mrb_realloc_simple (gc.c:209)
==561369==    by 0x131478: mrb_realloc (gc.c:223)
==561369==    by 0x131478: mrb_malloc (gc.c:245)
==561369==    by 0x12A4AA: ary_expand_capa (array.c:215)
==561369==    by 0x12BA5A: mrb_ary_unshift_m (array.c:636)
==561369==    by 0x12393D: mrb_vm_exec (vm.c:1444)
==561369==    by 0x128A43: mrb_vm_run (vm.c:947)
==561369==    by 0x14E44E: mrb_load_exec (parse.y:6339)
==561369==    by 0x10DC3E: main (mruby.c:270)
==561369== 
==561369== Invalid read of size 8
==561369==    at 0x12BA08: mrb_ary_unshift_m (array.c:643)
==561369==    by 0x12393D: mrb_vm_exec (vm.c:1444)
==561369==    by 0x128A43: mrb_vm_run (vm.c:947)
==561369==    by 0x14E44E: mrb_load_exec (parse.y:6339)
==561369==    by 0x10DC3E: main (mruby.c:270)
==561369==  Address 0x4ce5940 is 32 bytes inside a block of size 64 free'd
==561369==    at 0x483AD7B: realloc (vg_replace_malloc.c:836)
==561369==    by 0x131004: mrb_realloc_simple (gc.c:209)
==561369==    by 0x131004: mrb_realloc (gc.c:223)
==561369==    by 0x12A47F: ary_expand_capa (array.c:224)
==561369==    by 0x12BA5A: mrb_ary_unshift_m (array.c:636)
==561369==    by 0x12393D: mrb_vm_exec (vm.c:1444)
==561369==    by 0x128A43: mrb_vm_run (vm.c:947)
==561369==    by 0x14E44E: mrb_load_exec (parse.y:6339)
==561369==    by 0x10DC3E: main (mruby.c:270)
==561369==  Block was alloc'd at
==561369==    at 0x48386AF: malloc (vg_replace_malloc.c:308)
==561369==    by 0x483ADE7: realloc (vg_replace_malloc.c:836)
==561369==    by 0x131478: mrb_realloc_simple (gc.c:209)
==561369==    by 0x131478: mrb_realloc (gc.c:223)
==561369==    by 0x131478: mrb_malloc (gc.c:245)
==561369==    by 0x12A4AA: ary_expand_capa (array.c:215)
==561369==    by 0x12BA5A: mrb_ary_unshift_m (array.c:636)
==561369==    by 0x12393D: mrb_vm_exec (vm.c:1444)
==561369==    by 0x128A43: mrb_vm_run (vm.c:947)
==561369==    by 0x14E44E: mrb_load_exec (parse.y:6339)
==561369==    by 0x10DC3E: main (mruby.c:270)
==561369== 
==561369== 
==561369== HEAP SUMMARY:
==561369==     in use at exit: 0 bytes in 0 blocks
==561369==   total heap usage: 3,072 allocs, 3,072 frees, 333,033 bytes allocated
==561369== 
==561369== All heap blocks were freed -- no leaks are possible
==561369== 
==561369== For lists of detected and suppressed errors, rerun with: -s
==561369== ERROR SUMMARY: 8 errors from 4 contexts (suppressed: 0 from 0)