Merge branch 'maint'

* maint:
  erts: Fix integer overflow in loader
  erts: Fix integer overflow in list subtraction

2 files changed, 23 insertions, 2 deletions

diff --git a/erts/emulator/beam/beam_load.c b/erts/emulator/beam/beam_load.c
index 9add87d944..3d5683f19f 100644
--- a/erts/emulator/beam/beam_load.c
+++ b/erts/emulator/beam/beam_load.c
@@ -4615,7 +4615,15 @@ typedef struct SortGenOpArg {
 static int
 genopargtermcompare(SortGenOpArg* a, SortGenOpArg* b)
 {
-    return CMP_TERM(a->term, b->term);
+    Sint res = CMP_TERM(a->term, b->term);
+
+    if (res < 0) {
+        return -1;
+    } else if (res > 0) {
+        return 1;
+    }
+
+    return 0;
 }
 
 static int
diff --git a/erts/emulator/beam/erl_bif_lists.c b/erts/emulator/beam/erl_bif_lists.c
index b23fa77f5f..fa2edfef1e 100644
--- a/erts/emulator/beam/erl_bif_lists.c
+++ b/erts/emulator/beam/erl_bif_lists.c
@@ -413,12 +413,25 @@ typedef struct {
 #define ERTS_RBT_GET_LEFT(T) ((T)->left)
 #define ERTS_RBT_SET_LEFT(T, L) ((T)->left = (L))
 #define ERTS_RBT_GET_KEY(T) ((T)->key)
-#define ERTS_RBT_CMP_KEYS(KX, KY) CMP_TERM(KX, KY)
+#define ERTS_RBT_CMP_KEYS(KX, KY) subtract_term_cmp((KX), (KY))
 #define ERTS_RBT_WANT_LOOKUP_INSERT
 #define ERTS_RBT_WANT_LOOKUP
 #define ERTS_RBT_WANT_DELETE
 #define ERTS_RBT_UNDEF
 
+/* erl_rbtree expects comparisons to return an int */
+static int subtract_term_cmp(Eterm a, Eterm b) {
+    Sint res = CMP_TERM(a, b);
+
+    if (res < 0) {
+        return -1;
+    } else if (res > 0) {
+        return 1;
+    }
+
+    return 0;
+}
+
 #include "erl_rbtree.h"
 
 static int subtract_continue(Process *p, ErtsSubtractContext *context);