erts: Fix bug with enif_make_copy reallocating writable binary

that could invalidate a pointer received from an earlier
call to enif_inspect_binary.

Solution: Emasculate writable binary at enif_inspect_binary. There are
room for optimizations here as we now do an unconditional emasculation
even though enif_make_copy is not called later in the NIF.

1 files changed, 21 insertions, 0 deletions

diff --git a/erts/emulator/test/nif_SUITE_data/nif_SUITE.c b/erts/emulator/test/nif_SUITE_data/nif_SUITE.c
index 955dc64189..25e20f3e7d 100644
--- a/erts/emulator/test/nif_SUITE_data/nif_SUITE.c
+++ b/erts/emulator/test/nif_SUITE_data/nif_SUITE.c
@@ -1473,6 +1473,26 @@ static ERL_NIF_TERM otp_9668_nif(ErlNifEnv* env, int argc, const ERL_NIF_TERM ar
     return atom_ok;
 }
 
+static ERL_NIF_TERM otp_9828_nif(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[])
+{
+    /* copy a writable binary could reallocate it due to "emasculation"
+       and thereby render a previous inspection invalid.
+     */
+    ErlNifBinary bin1;
+    ErlNifEnv* myenv;
+
+    if (!enif_inspect_binary(env, argv[0], &bin1)) {
+	return enif_make_badarg(env);
+    }
+
+    myenv = enif_alloc_env();
+    enif_make_copy(myenv, argv[0]);
+    enif_free_env(myenv);
+
+    return memcmp(bin1.data, "I'm alive!", 10)==0 ? atom_ok : atom_false;
+}
+
+
 static ERL_NIF_TERM consume_timeslice_nif(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[])
 {
     int percent;
@@ -1741,6 +1761,7 @@ static ErlNifFunc nif_funcs[] =
     {"echo_int", 1, echo_int},
     {"type_sizes", 0, type_sizes},
     {"otp_9668_nif", 1, otp_9668_nif},
+    {"otp_9828_nif", 1, otp_9828_nif},
     {"consume_timeslice_nif", 2, consume_timeslice_nif},
 #ifdef ERL_NIF_DIRTY_SCHEDULER_SUPPORT
     {"call_dirty_nif", 3, call_dirty_nif},