1 files changed, 83 insertions, 8 deletions

diff --git a/erts/emulator/beam/bif.c b/erts/emulator/beam/bif.c
index 98dc9a3902..97c8114437 100644
--- a/erts/emulator/beam/bif.c
+++ b/erts/emulator/beam/bif.c
@@ -2421,9 +2421,7 @@ BIF_RETTYPE setelement_3(BIF_ALIST_3)
 
     /* copy the tuple */
     resp = hp;
-    while (size--) {		/* XXX use memcpy? */
-	*hp++ = *ptr++;
-    }
+    sys_memcpy(hp, ptr, sizeof(Eterm)*size);
     resp[ix] = BIF_ARG_3;
     BIF_RET(make_tuple(resp));
 }
@@ -2436,7 +2434,7 @@ BIF_RETTYPE make_tuple_2(BIF_ALIST_2)
     Eterm* hp;
     Eterm res;
 
-    if (is_not_small(BIF_ARG_1) || (n = signed_val(BIF_ARG_1)) < 0) {
+    if (is_not_small(BIF_ARG_1) || (n = signed_val(BIF_ARG_1)) < 0 || n > ERTS_MAX_TUPLE_SIZE) {
 	BIF_ERROR(BIF_P, BADARG);
     }
     hp = HAlloc(BIF_P, n+1);
@@ -2457,7 +2455,7 @@ BIF_RETTYPE make_tuple_3(BIF_ALIST_3)
     Eterm list = BIF_ARG_3;
     Eterm* tup;
 
-    if (is_not_small(BIF_ARG_1) || (n = signed_val(BIF_ARG_1)) < 0) {
+    if (is_not_small(BIF_ARG_1) || (n = signed_val(BIF_ARG_1)) < 0 || n > ERTS_MAX_TUPLE_SIZE) {
     error:
 	BIF_ERROR(BIF_P, BADARG);
     }
@@ -2509,11 +2507,16 @@ BIF_RETTYPE append_element_2(BIF_ALIST_2)
     Eterm res;
 
     if (is_not_tuple(BIF_ARG_1)) {
+    error:
 	BIF_ERROR(BIF_P, BADARG);
     }
-    ptr = tuple_val(BIF_ARG_1);
+    ptr   = tuple_val(BIF_ARG_1);
     arity = arityval(*ptr);
-    hp = HAlloc(BIF_P, arity + 2);
+
+    if (arity + 1 > ERTS_MAX_TUPLE_SIZE)
+	goto error;
+
+    hp  = HAlloc(BIF_P, arity + 2);
     res = make_tuple(hp);
     *hp = make_arityval(arity+1);
     while (arity--) {
@@ -2523,6 +2526,78 @@ BIF_RETTYPE append_element_2(BIF_ALIST_2)
     BIF_RET(res);
 }
 
+BIF_RETTYPE insert_element_3(BIF_ALIST_3)
+{
+    Eterm* ptr;
+    Eterm* hp;
+    Uint arity;
+    Eterm res;
+    Sint ix;
+
+    if (is_not_tuple(BIF_ARG_2) || is_not_small(BIF_ARG_1)) {
+	BIF_ERROR(BIF_P, BADARG);
+    }
+
+    ptr   = tuple_val(BIF_ARG_2);
+    arity = arityval(*ptr);
+    ix    = signed_val(BIF_ARG_1);
+
+    if ((ix < 1) || (ix > (arity + 1))) {
+	BIF_ERROR(BIF_P, BADARG);
+    }
+
+    hp  = HAlloc(BIF_P, arity + 1 + 1);
+    res = make_tuple(hp);
+    *hp = make_arityval(arity + 1);
+
+    ix--;
+    arity -= ix;
+
+    while (ix--) { *++hp = *++ptr; }
+
+    *++hp = BIF_ARG_3;
+
+    while(arity--) { *++hp = *++ptr; }
+
+    BIF_RET(res);
+}
+
+BIF_RETTYPE delete_element_2(BIF_ALIST_3)
+{
+    Eterm* ptr;
+    Eterm* hp;
+    Uint arity;
+    Eterm res;
+    Sint ix;
+
+    if (is_not_tuple(BIF_ARG_2) || is_not_small(BIF_ARG_1)) {
+	BIF_ERROR(BIF_P, BADARG);
+    }
+
+    ptr   = tuple_val(BIF_ARG_2);
+    arity = arityval(*ptr);
+    ix    = signed_val(BIF_ARG_1);
+
+    if ((ix < 1) || (ix > arity) || (arity == 0)) {
+	BIF_ERROR(BIF_P, BADARG);
+    }
+
+    hp  = HAlloc(BIF_P, arity + 1 - 1);
+    res = make_tuple(hp);
+    *hp = make_arityval(arity - 1);
+
+    ix--;
+    arity -= ix;
+
+    while (ix--) { *++hp = *++ptr; }
+
+    ++ptr;
+
+    while(arity--) { *++hp = *++ptr; }
+
+    BIF_RET(res);
+}
+
 /**********************************************************************/
 
 /* convert an atom to a list of ascii integer */
@@ -3097,7 +3172,7 @@ BIF_RETTYPE list_to_tuple_1(BIF_ALIST_1)
     Eterm* hp;
     int len;
 
-    if ((len = list_length(list)) < 0) {
+    if ((len = list_length(list)) < 0 || len > ERTS_MAX_TUPLE_SIZE) {
 	BIF_ERROR(BIF_P, BADARG);
     }