diff --git a/src/colony/lua_tm.c b/src/colony/lua_tm.c
index 8870d51d..72794d8f 100644
--- a/src/colony/lua_tm.c
+++ b/src/colony/lua_tm.c
@@ -672,24 +672,32 @@ static int l_tm_buffer_write_double (lua_State *L)
 static int l_tm_buffer_fill (lua_State *L)
 {
   uint8_t *a = (uint8_t *) lua_touserdata(L, 1);
-  int start = (int) lua_tonumber(L, 3);
+  int pos = (int) lua_tonumber(L, 3);
   int end = (int) lua_tonumber(L, 4);
 
   if (lua_isnumber(L, 2)) {
     uint8_t value = (uint8_t) lua_tonumber(L, 2);
-    memset(a + start, value, end - start);
+    memset(a + pos, value, end - pos);
     return 0;
   }
 
   int len = (int) lua_objlen(L, 2);
 
   if (len == 0) {
-    memset(a + start, 0, end - start);
+    memset(a + pos, 0, end - pos);
     return 0;
   }
 
   const char *source = lua_tostring(L, 2);
-  memset(a + start, source[0], end - start);
+
+  while (pos < end - len) {
+    memcpy(a + pos, source, len);
+    pos += len;
+  }
+
+  if (pos < end) {
+    memcpy(a + pos, source, end - pos);
+  }
 
   return 0;
 }
diff --git a/test/issues/issue-runtime-659.js b/test/issues/issue-runtime-659.js
index ace0dd9c..9e5a7d42 100644
--- a/test/issues/issue-runtime-659.js
+++ b/test/issues/issue-runtime-659.js
@@ -10,15 +10,15 @@ tap.eq('aaaa', b.toString(), 'buffer contains "aaaa"');
 
 b = new Buffer(4);
 b.fill('ab');
-tap.eq('aaaa', b.toString(), 'buffer contains "aaaa"');
+tap.eq('abab', b.toString(), 'buffer contains "abab"');
 
 b = new Buffer(4);
 b.fill('abc');
-tap.eq('aaaa', b.toString(), 'buffer contains "aaaa"');
+tap.eq('abca', b.toString(), 'buffer contains "abca"');
 
 b = new Buffer(10);
 b.fill('abc');
-tap.eq('aaaaaaaaaa', b.toString(), 'buffer contains "aaaaaaaaaa"');
+tap.eq('abcabcabca', b.toString(), 'buffer contains "abcabcabca"');
 
 b = new Buffer([0x10, 0x20, 0x30, 0x40]);
 b.fill('');