diff options
| author | Sverker Eriksson <[email protected]> | 2013-11-18 16:56:40 +0100 |
|---|---|---|
| committer | Sverker Eriksson <[email protected]> | 2013-11-18 17:03:55 +0100 |
| commit | ee0ca14382e76d97285e64b3396fbb87f33e23da (patch) | |
| tree | e1c8ce7912b0808d5669f69cdb031111e439f14f /erts/emulator/beam | |
| parent | 20641fe0f2ea745873fc7557448d3a7deb1bd639 (diff) | |
| download | otp-ee0ca14382e76d97285e64b3396fbb87f33e23da.tar.gz otp-ee0ca14382e76d97285e64b3396fbb87f33e23da.tar.bz2 otp-ee0ca14382e76d97285e64b3396fbb87f33e23da.zip | |
erts: Fix bugs in binary_to_term for invalid bitstrings
<<131, 77, Len:32, Bits:8, Data/binary>>
badarg if Bits > 8
Used to return internally inconsistent bitstring
badarg if Len==0 and Bits > 0
Used to return invalid *huge* binary (size = (Uint)-1)
badarg if Bits==0 and Len > 0
Used to return valid binary as if Bits was 8
Diffstat (limited to 'erts/emulator/beam')
| -rw-r--r-- | erts/emulator/beam/erl_binary.h | 2 | ||||
| -rw-r--r-- | erts/emulator/beam/external.c | 8 |
2 files changed, 6 insertions, 4 deletions
diff --git a/erts/emulator/beam/erl_binary.h b/erts/emulator/beam/erl_binary.h index 506c4813fa..24b10cffef 100644 --- a/erts/emulator/beam/erl_binary.h +++ b/erts/emulator/beam/erl_binary.h @@ -225,7 +225,7 @@ erts_free_aligned_binary_bytes(byte* buf) ** These extra bytes where earlier (< R13B04) added by an alignment-bug ** in this code. Do we dare remove this in some major release (R14?) maybe? */ -#ifdef DEBUG +#if defined(DEBUG) || defined(VALGRIND) # define CHICKEN_PAD 0 #else # define CHICKEN_PAD (sizeof(void*) - 1) diff --git a/erts/emulator/beam/external.c b/erts/emulator/beam/external.c index 1c88765381..cfdd38df73 100644 --- a/erts/emulator/beam/external.c +++ b/erts/emulator/beam/external.c @@ -3007,7 +3007,9 @@ dec_term_atom_common: n = get_int32(ep); bitsize = ep[4]; - ep += 5; + if (((bitsize==0) != (n==0)) || bitsize > 8) + goto error; + ep += 5; if (n <= ERL_ONHEAP_BIN_LIMIT) { ErlHeapBin* hb = (ErlHeapBin *) hp; @@ -3035,10 +3037,10 @@ dec_term_atom_common: hp += PROC_BIN_SIZE; } ep += n; - if (bitsize == 0) { + if (bitsize == 8 || n == 0) { *objp = bin; } else { - sb = (ErlSubBin *) hp; + sb = (ErlSubBin *)hp; sb->thing_word = HEADER_SUB_BIN; sb->orig = bin; sb->size = n - 1; |