diff options
| author | Björn-Egil Dahlberg <[email protected]> | 2012-10-25 18:16:53 +0200 |
|---|---|---|
| committer | Björn-Egil Dahlberg <[email protected]> | 2012-11-27 18:05:48 +0100 |
| commit | bb166aee88c4f075dfa4b069caece05b15cc1cc7 (patch) | |
| tree | fb1b3a04a1a28fb27a4e4057f956784e68b8ca24 /erts/emulator/beam/bif.c | |
| parent | e05a6c89abedfdff8ea16c645bd2b659c829cbfe (diff) | |
| download | otp-bb166aee88c4f075dfa4b069caece05b15cc1cc7.tar.gz otp-bb166aee88c4f075dfa4b069caece05b15cc1cc7.tar.bz2 otp-bb166aee88c4f075dfa4b069caece05b15cc1cc7.zip | |
erts: Enforce tuple max size on BIFs
Diffstat (limited to 'erts/emulator/beam/bif.c')
| -rw-r--r-- | erts/emulator/beam/bif.c | 15 |
1 files changed, 10 insertions, 5 deletions
diff --git a/erts/emulator/beam/bif.c b/erts/emulator/beam/bif.c index 1cdce49eef..6d94632971 100644 --- a/erts/emulator/beam/bif.c +++ b/erts/emulator/beam/bif.c @@ -2443,7 +2443,7 @@ BIF_RETTYPE make_tuple_2(BIF_ALIST_2) Eterm* hp; Eterm res; - if (is_not_small(BIF_ARG_1) || (n = signed_val(BIF_ARG_1)) < 0) { + if (is_not_small(BIF_ARG_1) || (n = signed_val(BIF_ARG_1)) < 0 || n > ERTS_MAX_TUPLE_SIZE) { BIF_ERROR(BIF_P, BADARG); } hp = HAlloc(BIF_P, n+1); @@ -2464,7 +2464,7 @@ BIF_RETTYPE make_tuple_3(BIF_ALIST_3) Eterm list = BIF_ARG_3; Eterm* tup; - if (is_not_small(BIF_ARG_1) || (n = signed_val(BIF_ARG_1)) < 0) { + if (is_not_small(BIF_ARG_1) || (n = signed_val(BIF_ARG_1)) < 0 || n > ERTS_MAX_TUPLE_SIZE) { error: BIF_ERROR(BIF_P, BADARG); } @@ -2516,11 +2516,16 @@ BIF_RETTYPE append_element_2(BIF_ALIST_2) Eterm res; if (is_not_tuple(BIF_ARG_1)) { + error: BIF_ERROR(BIF_P, BADARG); } - ptr = tuple_val(BIF_ARG_1); + ptr = tuple_val(BIF_ARG_1); arity = arityval(*ptr); - hp = HAlloc(BIF_P, arity + 2); + + if (arity + 1 > ERTS_MAX_TUPLE_SIZE) + goto error; + + hp = HAlloc(BIF_P, arity + 2); res = make_tuple(hp); *hp = make_arityval(arity+1); while (arity--) { @@ -3104,7 +3109,7 @@ BIF_RETTYPE list_to_tuple_1(BIF_ALIST_1) Eterm* hp; int len; - if ((len = list_length(list)) < 0) { + if ((len = list_length(list)) < 0 || len > ERTS_MAX_TUPLE_SIZE) { BIF_ERROR(BIF_P, BADARG); } |