aboutsummaryrefslogtreecommitdiffstats
path: root/lib/hipe/test/bs_SUITE_data
diff options
context:
space:
mode:
authorKostis Sagonas <[email protected]>2015-10-12 07:53:20 +0200
committerKostis Sagonas <[email protected]>2015-10-12 07:53:20 +0200
commitd94a8ef6dc136dd2eedf3c3ad4bc053ca8fdd1b0 (patch)
treea5e54dfd9d03b28ab6ede0cca054ad5892edaa2d /lib/hipe/test/bs_SUITE_data
parent4f9905824002bebc33c2914669b4c364927cb0ee (diff)
downloadotp-d94a8ef6dc136dd2eedf3c3ad4bc053ca8fdd1b0.tar.gz
otp-d94a8ef6dc136dd2eedf3c3ad4bc053ca8fdd1b0.tar.bz2
otp-d94a8ef6dc136dd2eedf3c3ad4bc053ca8fdd1b0.zip
Fix edge case of Size = 0 in bs_put_integer
copy_offset_int_big was assuming (Offset + Size - 1) (Tmp9 in the first BB) would not underflow. It was also unconditionally reading and writing the binary even when Size was zero, unlike copy_int_little, which is the only other case of bs_put_integer that does not have a short-circuit on Size = 0. This was causing segfaults when constructing binaries starting with a zero-length integer field, because a logical right shift was used to compute an offset in bytes (which became 0x1fffffffffffffff) to read in the binary. Tests, taken from the emulator bs_construct_SUITE, were also added. The complete credit for the report and the fix goes to Magnus Lång.
Diffstat (limited to 'lib/hipe/test/bs_SUITE_data')
-rw-r--r--lib/hipe/test/bs_SUITE_data/bs_construct.erl16
1 files changed, 16 insertions, 0 deletions
diff --git a/lib/hipe/test/bs_SUITE_data/bs_construct.erl b/lib/hipe/test/bs_SUITE_data/bs_construct.erl
index 9cc9ac848c..37a54c1981 100644
--- a/lib/hipe/test/bs_SUITE_data/bs_construct.erl
+++ b/lib/hipe/test/bs_SUITE_data/bs_construct.erl
@@ -13,6 +13,7 @@ test() ->
ok = bs5(),
16#10000008 = bit_size(large_bin(1, 2, 3, 4)),
ok = bad_ones(),
+ ok = zero_width(),
ok.
%%--------------------------------------------------------------------
@@ -126,3 +127,18 @@ bad_ones() ->
Bin123 = <<1,2,3>>,
?FAIL(<<Bin123/float>>),
ok.
+
+%%--------------------------------------------------------------------
+%% Taken from the emulator bs_construct_SUITE - seg faulted till 18.1
+
+zero_width() ->
+ Z = id(0),
+ Small = id(42),
+ Big = id(1 bsl 128), % puts stuff on the heap
+ <<>> = <<Small:Z>>,
+ <<>> = <<Small:0>>,
+ <<>> = <<Big:Z>>,
+ <<>> = <<Big:0>>,
+ ok.
+
+id(X) -> X.