Comment by CodesInChaos

Your bump allocator suffers from integer overflows turned into buffer overflows when the requested allocation is big enough:

  if (a->cursor + size > a->limit) return NULL; // out of memory

I'd rewrite it like this:

  if (size > a->limit - a->cursor) return NULL; // out of memory