Merge branch 'sverker/load-corrupt-beam/ERL-216/OTP-13848' into maint

* sverker/load-corrupt-beam/ERL-216:
  erts:: Unsignify a bunch of loader variables
  erts: Reject an invalid beam code header size
  erts: Fix load of beam with invalid imports and atom numbers

1 files changed, 61 insertions, 57 deletions

diff --git a/erts/emulator/beam/beam_load.c b/erts/emulator/beam/beam_load.c
index b2c4fe5f5e..b7e802775d 100644
--- a/erts/emulator/beam/beam_load.c
+++ b/erts/emulator/beam/beam_load.c
@@ -105,7 +105,7 @@ typedef struct {
  */
 
 typedef struct genop {
-    int op;			/* Opcode. */
+    unsigned int op;		/* Opcode. */
     int arity;			/* Number of arguments. */
     GenOpArg def_args[MAX_OPARGS]; /* Default buffer for arguments. */
     GenOpArg* a;		/* The arguments. */
@@ -283,8 +283,8 @@ typedef struct LoaderState {
     byte* code_start;		/* Start of code file. */
     unsigned code_size;		/* Size of code file. */
     int specific_op;		/* Specific opcode (-1 if not found). */
-    int num_functions;		/* Number of functions in module. */
-    int num_labels;		/* Number of labels. */
+    unsigned int num_functions; /* Number of functions in module. */
+    unsigned int num_labels;	/* Number of labels. */
     BeamCodeHeader* hdr;	/* Loaded code header */
     BeamInstr* codev;	        /* Loaded code buffer */
     int        codev_size;      /* Size of code buffer in words. */
@@ -303,13 +303,13 @@ typedef struct LoaderState {
      * Atom table.
      */
 
-    int num_atoms;		/* Number of atoms in atom table. */
+    unsigned int num_atoms;	/* Number of atoms in atom table. */
     Eterm* atom;		/* Atom table. */
 
-    int num_exps;		/* Number of exports. */
+    unsigned int num_exps;	/* Number of exports. */
     ExportEntry* export;	/* Pointer to export table. */
 
-    int num_imports;		/* Number of imports. */
+    unsigned int num_imports;   /* Number of imports. */
     ImportEntry* import;	/* Import entry (translated information). */
 
     /*
@@ -323,8 +323,8 @@ typedef struct LoaderState {
      * Lambda table.
      */
 
-    int num_lambdas;		/* Number of lambdas in table. */
-    int lambdas_allocated;	/* Size of allocated lambda table. */
+    unsigned int num_lambdas;	/* Number of lambdas in table. */
+    unsigned int lambdas_allocated; /* Size of allocated lambda table. */
     Lambda* lambdas;		/* Pointer to lambdas. */
     Lambda def_lambdas[16];	/* Default storage for lambda table. */
     char* lambda_error;		/* Delayed missing 'FunT' error. */
@@ -333,8 +333,8 @@ typedef struct LoaderState {
      * Literals (constant pool).
      */
 
-    int num_literals;		/* Number of literals in table. */
-    int allocated_literals;	/* Number of literal entries allocated. */
+    unsigned int num_literals;	/* Number of literals in table. */
+    unsigned int allocated_literals; /* Number of literal entries allocated. */
     Literal* literals;		/* Array of literals. */
     LiteralPatch* literal_patches; /* Operands that need to be patched. */
     Uint total_literal_size;	/* Total heap size for all literals. */
@@ -343,13 +343,13 @@ typedef struct LoaderState {
      * Line table.
      */
     BeamInstr* line_item;	/* Line items from the BEAM file. */
-    int num_line_items;		/* Number of line items. */
+    unsigned int num_line_items;/* Number of line items. */
     LineInstr* line_instr;	/* Line instructions */
-    int num_line_instrs;	/* Maximum number of line instructions */
-    int current_li;		/* Current line instruction */
-    int* func_line;		/* Mapping from function to first line instr */
+    unsigned int num_line_instrs; /* Maximum number of line instructions */
+    unsigned int current_li;	/* Current line instruction */
+    unsigned int* func_line;	/* Mapping from function to first line instr */
     Eterm* fname;		/* List of file names */
-    int num_fnames;		/* Number of filenames in fname table */
+    unsigned int num_fnames;	/* Number of filenames in fname table */
     int loc_size;		/* Size of location info in bytes (2/4) */
 } LoaderState;
 
@@ -1331,7 +1331,7 @@ verify_chunks(LoaderState* stp)
 static int
 load_atom_table(LoaderState* stp)
 {
-    int i;
+    unsigned int i;
 
     GetInt(stp, 4, stp->num_atoms);
     stp->num_atoms++;
@@ -1376,13 +1376,13 @@ load_atom_table(LoaderState* stp)
 static int
 load_import_table(LoaderState* stp)
 {
-    int i;
+    unsigned int i;
 
     GetInt(stp, 4, stp->num_imports);
     stp->import = erts_alloc(ERTS_ALC_T_PREPARED_CODE,
 			     stp->num_imports * sizeof(ImportEntry));
     for (i = 0; i < stp->num_imports; i++) {
-	int n;
+	unsigned int n;
 	Eterm mod;
 	Eterm func;
 	Uint arity;
@@ -1390,17 +1390,17 @@ load_import_table(LoaderState* stp)
 
 	GetInt(stp, 4, n);
 	if (n >= stp->num_atoms) {
-	    LoadError2(stp, "import entry %d: invalid atom number %d", i, n);
+	    LoadError2(stp, "import entry %u: invalid atom number %u", i, n);
 	}
 	mod = stp->import[i].module = stp->atom[n];
 	GetInt(stp, 4, n);
 	if (n >= stp->num_atoms) {
-	    LoadError2(stp, "import entry %d: invalid atom number %d", i, n);
+	    LoadError2(stp, "import entry %u: invalid atom number %u", i, n);
 	}
 	func = stp->import[i].function = stp->atom[n];
 	GetInt(stp, 4, arity);
 	if (arity > MAX_REG) {
-	    LoadError2(stp, "import entry %d: invalid arity %d", i, arity);
+	    LoadError2(stp, "import entry %u: invalid arity %d", i, arity);
 	}
 	stp->import[i].arity = arity;
 	stp->import[i].patches = 0;
@@ -1428,12 +1428,12 @@ load_import_table(LoaderState* stp)
 static int
 read_export_table(LoaderState* stp)
 {
-    int i;
+    unsigned int i;
     BeamInstr* address;
 
     GetInt(stp, 4, stp->num_exps);
     if (stp->num_exps > stp->num_functions) {
-	LoadError2(stp, "%d functions exported; only %d functions defined",
+	LoadError2(stp, "%u functions exported; only %u functions defined",
 		   stp->num_exps, stp->num_functions);
     }
     stp->export
@@ -1451,16 +1451,16 @@ read_export_table(LoaderState* stp)
 	stp->export[i].function = func;
 	GetInt(stp, 4, arity);
 	if (arity > MAX_REG) {
-	    LoadError2(stp, "export table entry %d: absurdly high arity %d", i, arity);
+	    LoadError2(stp, "export table entry %u: absurdly high arity %u", i, arity);
 	}
 	stp->export[i].arity = arity;
 	GetInt(stp, 4, n);
 	if (n >= stp->num_labels) {
-	    LoadError3(stp, "export table entry %d: invalid label %d (highest defined label is %d)", i, n, stp->num_labels);
+	    LoadError3(stp, "export table entry %u: invalid label %u (highest defined label is %u)", i, n, stp->num_labels);
 	}
 	value = stp->labels[n].value;
 	if (value == 0) {
-	    LoadError2(stp, "export table entry %d: label %d not resolved", i, n);
+	    LoadError2(stp, "export table entry %u: label %u not resolved", i, n);
 	}
 	stp->export[i].address = address = stp->codev + value;
 
@@ -1521,7 +1521,7 @@ is_bif(Eterm mod, Eterm func, unsigned arity)
 static int
 read_lambda_table(LoaderState* stp)
 {
-    int i;
+    unsigned int i;
 
     GetInt(stp, 4, stp->num_lambdas);
     if (stp->num_lambdas > stp->lambdas_allocated) {
@@ -1541,12 +1541,12 @@ read_lambda_table(LoaderState* stp)
 	GetAtom(stp, n, stp->lambdas[i].function);
 	GetInt(stp, 4, arity);
 	if (arity > MAX_REG) {
-	    LoadError2(stp, "lambda entry %d: absurdly high arity %d", i, arity);
+	    LoadError2(stp, "lambda entry %u: absurdly high arity %u", i, arity);
 	}
 	stp->lambdas[i].arity = arity;
 	GetInt(stp, 4, n);
 	if (n >= stp->num_labels) {
-	    LoadError3(stp, "lambda entry %d: invalid label %d (highest defined label is %d)",
+	    LoadError3(stp, "lambda entry %u: invalid label %u (highest defined label is %u)",
 		       i, n, stp->num_labels);
 	}
 	stp->lambdas[i].label = n;
@@ -1567,7 +1567,7 @@ read_lambda_table(LoaderState* stp)
 static int
 read_literal_table(LoaderState* stp)
 {
-    int i;
+    unsigned int i;
     uLongf uncompressed_sz;
     byte* uncompressed = 0;
 
@@ -1589,7 +1589,7 @@ read_literal_table(LoaderState* stp)
     }
 
     for (i = 0; i < stp->num_literals; i++) {
-	int sz;
+	Uint sz;
 	Sint heap_size;
 	byte* p;
 	Eterm val;
@@ -1598,7 +1598,7 @@ read_literal_table(LoaderState* stp)
 	GetInt(stp, 4, sz);	/* Size of external term format. */
 	GetString(stp, p, sz);
 	if ((heap_size = erts_decode_ext_size(p, sz)) < 0) {
-	    LoadError1(stp, "literal %d: bad external format", i);
+	    LoadError1(stp, "literal %u: bad external format", i);
 	}
 
         if (heap_size > 0) {
@@ -1608,7 +1608,7 @@ read_literal_table(LoaderState* stp)
             val = erts_decode_ext(&factory, &p, 0);
 
             if (is_non_value(val)) {
-                LoadError1(stp, "literal %d: bad external format", i);
+                LoadError1(stp, "literal %u: bad external format", i);
             }
             erts_factory_close(&factory);
             stp->literals[i].heap_frags = factory.heap_frags;
@@ -1618,7 +1618,7 @@ read_literal_table(LoaderState* stp)
             erts_factory_dummy_init(&factory);
             val = erts_decode_ext(&factory, &p, 0);
             if (is_non_value(val)) {
-                LoadError1(stp, "literal %d: bad external format", i);
+                LoadError1(stp, "literal %u: bad external format", i);
             }
             ASSERT(is_immed(val));
             stp->literals[i].heap_frags = NULL;
@@ -1641,9 +1641,9 @@ read_line_table(LoaderState* stp)
 {
     unsigned version;
     ERTS_DECLARE_DUMMY(unsigned flags);
-    int num_line_items;
+    unsigned int num_line_items;
     BeamInstr* lp;
-    int i;
+    unsigned int i;
     BeamInstr fname_index;
     BeamInstr tag;
 
@@ -1722,7 +1722,7 @@ read_line_table(LoaderState* stp)
 	    }
 	} else if (tag == TAG_a) {
 	    if (val > stp->num_fnames) {
-		LoadError2(stp, "file index overflow (%d/%d)",
+		LoadError2(stp, "file index overflow (%u/%u)",
 			   val, stp->num_fnames);
 	    }
 	    fname_index = val;
@@ -1758,9 +1758,9 @@ read_line_table(LoaderState* stp)
 					       stp->num_line_instrs *
 					       sizeof(LineInstr));
     stp->current_li = 0;
-    stp->func_line = (int *)  erts_alloc(ERTS_ALC_T_PREPARED_CODE,
-					 stp->num_functions *
-					 sizeof(int));
+    stp->func_line = (unsigned int *)  erts_alloc(ERTS_ALC_T_PREPARED_CODE,
+						  stp->num_functions *
+						  sizeof(int));
 
     return 1;
 
@@ -1784,6 +1784,10 @@ read_code_header(LoaderState* stp)
      */
 
     GetInt(stp, 4, head_size);
+    if (head_size > stp->file_left) {
+	LoadError2(stp, "invalid code header size %u; bytes left %u",
+		   head_size, stp->file_left);
+    }
     stp->code_start = stp->file_p + head_size;
     stp->code_size = stp->file_left - head_size;
     stp->file_left = head_size;
@@ -1888,7 +1892,7 @@ load_code(LoaderState* stp)
     ci = stp->ci;
 
     for (;;) {
-	int new_op;
+	unsigned int new_op;
 	GenOp* tmp_op;
 
 	ASSERT(ci <= codev_size);
@@ -1896,10 +1900,10 @@ load_code(LoaderState* stp)
     get_next_instr:
 	GetByte(stp, new_op);
 	if (new_op >= NUM_GENERIC_OPS) {
-	    LoadError1(stp, "invalid opcode %d", new_op);
+	    LoadError1(stp, "invalid opcode %u", new_op);
 	}
 	if (gen_opc[new_op].name[0] == '\0') {
-	    LoadError1(stp, "invalid opcode %d", new_op);
+	    LoadError1(stp, "invalid opcode %u", new_op);
 	}
 				       
 
@@ -2369,7 +2373,7 @@ load_code(LoaderState* stp)
 		VerifyTag(stp, tag, TAG_u);
 		last_label = tmp_op->a[arg].val;
 		if (!(0 < last_label && last_label < stp->num_labels)) {
-		    LoadError2(stp, "invalid label num %d (0 < label < %d)",
+		    LoadError2(stp, "invalid label num %u (0 < label < %u)",
 			       tmp_op->a[arg].val, stp->num_labels);
 		}
 		if (stp->labels[last_label].value != 0) {
@@ -2513,7 +2517,7 @@ load_code(LoaderState* stp)
 	    {
 		Sint offset;
 		if (function_number >= stp->num_functions) {
-		    LoadError1(stp, "too many functions in module (header said %d)",
+		    LoadError1(stp, "too many functions in module (header said %u)",
 			       stp->num_functions); 
 		}
 
@@ -2592,14 +2596,14 @@ load_code(LoaderState* stp)
 	    if (stp->line_item) {
 		BeamInstr item = code[ci-1];
 		BeamInstr loc;
-		int li;
+		unsigned int li;
 		if (item >= stp->num_line_items) {
-		    LoadError2(stp, "line instruction index overflow (%d/%d)",
+		    LoadError2(stp, "line instruction index overflow (%u/%u)",
 			       item, stp->num_line_items);
 		}
 		li = stp->current_li;
 		if (li >= stp->num_line_instrs) {
-		    LoadError2(stp, "line instruction table overflow (%d/%d)",
+		    LoadError2(stp, "line instruction table overflow (%u/%u)",
 			       li, stp->num_line_instrs);
 		}
 		loc = stp->line_item[item];
@@ -4603,8 +4607,8 @@ freeze_code(LoaderState* stp)
 	str_table = (byte *) (codev + stp->ci);
     } else {
 	BeamCodeLineTab* const line_tab = (BeamCodeLineTab *) (codev+stp->ci);
-	const int ftab_size = stp->num_functions;
-        const int num_instrs = stp->current_li;
+	const unsigned int ftab_size = stp->num_functions;
+        const unsigned int num_instrs = stp->current_li;
         const BeamInstr** const line_items =
             (const BeamInstr**) &line_tab->func_tab[ftab_size + 1];
 
@@ -4764,7 +4768,7 @@ freeze_code(LoaderState* stp)
 static void
 final_touch(LoaderState* stp, struct erl_module_instance* inst_p)
 {
-    int i;
+    unsigned int i;
     int on_load = stp->on_load;
     unsigned catches;
     Uint index;
@@ -5436,7 +5440,7 @@ new_genop(LoaderState* stp)
 static int
 new_label(LoaderState* stp)
 {
-    int num = stp->num_labels;
+    unsigned int num = stp->num_labels;
 
     stp->num_labels++;
     stp->labels = (Label *) erts_realloc(ERTS_ALC_T_PREPARED_CODE,
@@ -6056,11 +6060,11 @@ stub_copy_info(LoaderState* stp,
 static int
 stub_read_export_table(LoaderState* stp)
 {
-    int i;
+    unsigned int i;
 
     GetInt(stp, 4, stp->num_exps);
     if (stp->num_exps > stp->num_functions) {
-	LoadError2(stp, "%d functions exported; only %d functions defined",
+	LoadError2(stp, "%u functions exported; only %u functions defined",
 		   stp->num_exps, stp->num_functions);
     }
     stp->export
@@ -6074,7 +6078,7 @@ stub_read_export_table(LoaderState* stp)
 	GetAtom(stp, n, stp->export[i].function);
 	GetInt(stp, 4, n);
 	if (n > MAX_REG) {
-	    LoadError2(stp, "export table entry %d: absurdly high arity %d", i, n);
+	    LoadError2(stp, "export table entry %u: absurdly high arity %u", i, n);
 	}
 	stp->export[i].arity = n;
 	GetInt(stp, 4, n);	/* Ignore label */
@@ -6088,8 +6092,8 @@ stub_read_export_table(LoaderState* stp)
 static void
 stub_final_touch(LoaderState* stp, BeamInstr* fp)
 {
-    int i;
-    int n = stp->num_exps;
+    unsigned int i;
+    unsigned int n = stp->num_exps;
     Eterm mod = fp[2];
     Eterm function = fp[3];
     int arity = fp[4];