1 files changed, 31 insertions, 16 deletions

diff --git a/erts/emulator/beam/bs_instrs.tab b/erts/emulator/beam/bs_instrs.tab
index a4d4afe7d4..94e0000c8b 100644
--- a/erts/emulator/beam/bs_instrs.tab
+++ b/erts/emulator/beam/bs_instrs.tab
@@ -364,11 +364,9 @@ i_bs_init_bits_fail      := bs_init_bits.fail.verify.execute;
 i_bs_init_bits_fail_heap := bs_init_bits.fail_heap.verify.execute;
 
 bs_init_bits.head() {
-    Eterm new_binary;
     Eterm num_bits_term;
     Uint num_bits;
     Uint alloc;
-    Uint num_bytes;
 }
 
 bs_init_bits.plain(NumBits) {
@@ -410,7 +408,9 @@ bs_init_bits.verify(Fail) {
 }
 
 bs_init_bits.execute(Live, Dst) {
-     num_bytes = ((Uint64)num_bits+(Uint64)7) >> 3;
+     Eterm new_binary;
+     Uint num_bytes = ((Uint64)num_bits+(Uint64)7) >> 3;
+
      if (num_bits & 7) {
 	 alloc += ERL_SUB_BIN_SIZE;
      }
@@ -709,9 +709,6 @@ i_bs_validate_unicode_retract(Fail, Src, Ms) {
 i_bs_start_match2 := bs_start_match.fetch.execute;
 
 bs_start_match.head() {
-    Uint slots;
-    Uint live;
-    Eterm header;
     Eterm context;
 }
 
@@ -720,6 +717,9 @@ bs_start_match.fetch(Src) {
 }
 
 bs_start_match.execute(Fail, Live, Slots, Dst) {
+    Uint slots;
+    Uint live;
+    Eterm header;
     if (!is_boxed(context)) {
         $FAIL($Fail);
     }
@@ -919,9 +919,23 @@ i_bs_get_integer(Fail, Live, FlagsAndUnit, Ms, Sz, Dst) {
 }
 
 i_bs_get_utf8(Ctx, Fail, Dst) {
+    Eterm result;
     ErlBinMatchBuffer* mb = ms_matchbuffer($Ctx);
-    Eterm result = erts_bs_get_utf8(mb);
 
+    if (mb->size - mb->offset < 8) {
+        $FAIL($Fail);
+    }
+    if (BIT_OFFSET(mb->offset) != 0) {
+        result = erts_bs_get_utf8(mb);
+    } else {
+        byte b = mb->base[BYTE_OFFSET(mb->offset)];
+        if (b < 128) {
+            result = make_small(b);
+            mb->offset += 8;
+        } else {
+            result = erts_bs_get_utf8(mb);
+        }
+    }
     if (is_non_value(result)) {
         $FAIL($Fail);
     }
@@ -942,13 +956,10 @@ bs_context_to_binary := ctx_to_bin.fetch.execute;
 i_bs_get_binary_all_reuse := ctx_to_bin.fetch_bin.execute;
 
 ctx_to_bin.head() {
-     Eterm context;
-     ErlBinMatchBuffer* mb;
-     ErlSubBin* sb;
-     Uint size;
-     Uint offs;
-     Uint orig;
-     Uint hole_size;
+    Eterm context;
+    ErlBinMatchBuffer* mb;
+    Uint size;
+    Uint offs;
 }
 
 ctx_to_bin.fetch(Src) {
@@ -976,8 +987,12 @@ ctx_to_bin.fetch_bin(Src, Fail, Unit) {
 }
 
 ctx_to_bin.execute() {
-    orig = mb->orig;
-    sb = (ErlSubBin *) boxed_val(context);
+    Uint hole_size;
+    Uint orig = mb->orig;
+    ErlSubBin* sb = (ErlSubBin *) boxed_val(context);
+    /* Since we're going to overwrite the match state with the result, an
+     * ErlBinMatchState must be at least as large as an ErlSubBin. */
+    ERTS_CT_ASSERT(sizeof(ErlSubBin) <= sizeof(ErlBinMatchState));
     hole_size = 1 + header_arity(sb->thing_word) - ERL_SUB_BIN_SIZE;
     sb->thing_word = HEADER_SUB_BIN;
     sb->size = BYTE_OFFSET(size);