Drew Yao of the Apple Product Security team reported an integer overflow leading
to a bypass of memory re-allocation causing a heap overflow in the
rb_ary_splice() function used by ruby interpreter for handling arrays. 
Problematic addition that may overflow:

     if (beg >= RARRAY(ary)->len) {
-->    len = beg + rlen;  
       if (len >= RARRAY(ary)->aux.capa) {
         REALLOC_N(RARRAY(ary)->ptr, VALUE, len);

The addition may overflow causing len to be negative and due to that, REALLOC_N
is not called.
       
This flaw can be used to crash and possibly execute arbitrary code with the
privileges of Ruby application which use untrusted input in array operations.

Acknowledgements:

Red Hat would like to thank Drew Yao of the Apple Product Security team for reporting this issue.