aboutsummaryrefslogtreecommitdiffstats
path: root/erts/emulator/beam
diff options
context:
space:
mode:
authorSverker Eriksson <[email protected]>2012-02-20 19:53:32 +0100
committerSverker Eriksson <[email protected]>2012-02-21 12:10:40 +0100
commitde742bb6eb202c5a524bab3617a2ede918598705 (patch)
tree46685357e8a3ee9dacb2c2f0f2ae49f231916ed0 /erts/emulator/beam
parent75b831aa879234db6d8821a32f4c411ef6cfc6ff (diff)
downloadotp-de742bb6eb202c5a524bab3617a2ede918598705.tar.gz
otp-de742bb6eb202c5a524bab3617a2ede918598705.tar.bz2
otp-de742bb6eb202c5a524bab3617a2ede918598705.zip
erts: Fail binary_to_term if bignum arity is too large
Diffstat (limited to 'erts/emulator/beam')
-rw-r--r--erts/emulator/beam/external.c3
1 files changed, 3 insertions, 0 deletions
diff --git a/erts/emulator/beam/external.c b/erts/emulator/beam/external.c
index 152dbcf085..9d52ed4e98 100644
--- a/erts/emulator/beam/external.c
+++ b/erts/emulator/beam/external.c
@@ -3118,6 +3118,9 @@ decoded_size(byte *ep, byte* endp, int internal_tags)
case LARGE_BIG_EXT:
CHKSIZE(4);
n = get_int32(ep);
+ if (n > BIG_ARITY_MAX*sizeof(ErtsDigit)) {
+ return -1;
+ }
SKIP2(n,4+1); /* skip, size,sign,digits */
heap_size += 1+1+(n+sizeof(Eterm)-1)/sizeof(Eterm); /* XXX: 1 too much? */
break;