erts: Fix bugs in binary_to_term for invalid bitstrings

<<131, 77, Len:32, Bits:8, Data/binary>>

badarg if Bits > 8
	Used to return internally inconsistent bitstring

badarg if Len==0 and Bits > 0
	Used to return invalid *huge* binary (size = (Uint)-1)

badarg if Bits==0 and Len > 0
	Used to return valid binary as if Bits was 8

1 files changed, 5 insertions, 3 deletions

diff --git a/erts/emulator/beam/external.c b/erts/emulator/beam/external.c
index 1c88765381..cfdd38df73 100644
--- a/erts/emulator/beam/external.c
+++ b/erts/emulator/beam/external.c
@@ -3007,7 +3007,9 @@ dec_term_atom_common:
 
 		n = get_int32(ep);
 		bitsize = ep[4];
-		ep += 5;
+                if (((bitsize==0) != (n==0)) || bitsize > 8)
+                    goto error;
+                ep += 5;
 		if (n <= ERL_ONHEAP_BIN_LIMIT) {
 		    ErlHeapBin* hb = (ErlHeapBin *) hp;
 
@@ -3035,10 +3037,10 @@ dec_term_atom_common:
 		    hp += PROC_BIN_SIZE;
 		}
 		ep += n;
-		if (bitsize == 0) {
+		if (bitsize == 8 || n == 0) {
 		    *objp = bin;
 		} else {
-		    sb = (ErlSubBin *) hp;
+                    sb = (ErlSubBin *)hp;
 		    sb->thing_word = HEADER_SUB_BIN;
 		    sb->orig = bin;
 		    sb->size = n - 1;