7 files changed, 26 insertions, 12 deletions

diff --git a/lib/erl_interface/doc/src/ei.xml b/lib/erl_interface/doc/src/ei.xml
index de4e4b4301..76e02a6858 100644
--- a/lib/erl_interface/doc/src/ei.xml
+++ b/lib/erl_interface/doc/src/ei.xml
@@ -581,9 +581,9 @@ ei_x_encode_empty_list(&x);
           <c><![CDATA[term]]></c> union, it is decoded, and the appropriate field
           in <c><![CDATA[term->value]]></c> is set, and <c><![CDATA[*index]]></c> is
           incremented by the term size.</p>
-        <p>The function returns 0 on successful decoding, -1 on error,
-          and 1 if the term seems alright, but does not fit in the
-          <c><![CDATA[term]]></c> structure. If it returns 0, the <c><![CDATA[index]]></c>
+        <p>The function returns 1 on successful decoding, -1 on error,
+          and 0 if the term seems alright, but does not fit in the
+          <c><![CDATA[term]]></c> structure. If it returns 1, the <c><![CDATA[index]]></c>
           will be incremented, and the <c><![CDATA[term]]></c> contains the
           decoded term.</p>
         <p>The <c><![CDATA[term]]></c> structure will contain the arity for a tuple
diff --git a/lib/erl_interface/src/encode/encode_atom.c b/lib/erl_interface/src/encode/encode_atom.c
index 69f2d1451c..b1a4479034 100644
--- a/lib/erl_interface/src/encode/encode_atom.c
+++ b/lib/erl_interface/src/encode/encode_atom.c
@@ -17,13 +17,17 @@
  * %CopyrightEnd%
  */
 #include <string.h>
+#include <limits.h>
 #include "eidef.h"
 #include "eiext.h"
 #include "putget.h"
 
 int ei_encode_atom(char *buf, int *index, const char *p)
 {
-    return ei_encode_atom_len(buf, index, p, strlen(p));
+    size_t len = strlen(p);
+
+    if (len >= INT_MAX) return -1;
+    return ei_encode_atom_len(buf, index, p, len);
 }
 
 int ei_encode_atom_len(char *buf, int *index, const char *p, int len)
diff --git a/lib/erl_interface/src/encode/encode_string.c b/lib/erl_interface/src/encode/encode_string.c
index 1d342cb605..593bbf2b6d 100644
--- a/lib/erl_interface/src/encode/encode_string.c
+++ b/lib/erl_interface/src/encode/encode_string.c
@@ -17,6 +17,7 @@
  * %CopyrightEnd%
  */
 #include <string.h>
+#include <limits.h>
 #include "eidef.h"
 #include "eiext.h"
 #include "putget.h"
@@ -24,7 +25,10 @@
 
 int ei_encode_string(char *buf, int *index, const char *p)
 {
-    return ei_encode_string_len(buf, index, p, strlen(p));
+    size_t len = strlen(p);
+
+    if (len >= INT_MAX) return -1;
+    return ei_encode_string_len(buf, index, p, len);
 }
 
 int ei_encode_string_len(char *buf, int *index, const char *p, int len)
diff --git a/lib/erl_interface/src/legacy/erl_fix_alloc.c b/lib/erl_interface/src/legacy/erl_fix_alloc.c
index 20f3024e41..ca09fc3b8b 100644
--- a/lib/erl_interface/src/legacy/erl_fix_alloc.c
+++ b/lib/erl_interface/src/legacy/erl_fix_alloc.c
@@ -109,6 +109,10 @@ void *erl_eterm_alloc (void)
 	erl_eterm_state->freed--;      
     } else if ((b = malloc(sizeof(*b))) == NULL) {
 	erl_errno = ENOMEM;
+#ifdef _REENTRANT
+	ei_mutex_unlock(erl_eterm_state->lock);
+#endif /* _REENTRANT */
+	return NULL;
     }
     erl_eterm_state->allocated++;
     b->free = 0;
diff --git a/lib/erl_interface/src/misc/ei_decode_term.c b/lib/erl_interface/src/misc/ei_decode_term.c
index bfb4571337..0b82ef0e35 100644
--- a/lib/erl_interface/src/misc/ei_decode_term.c
+++ b/lib/erl_interface/src/misc/ei_decode_term.c
@@ -25,8 +25,8 @@
 #include "ei_decode_term.h"
 #include "putget.h"
 
-/* Returns 0 on successful encoding, -1 on error, and 1 if the term seems
-   alright, but does not fit in the term structure. If it returns 0, the
+/* Returns 1 on successful encoding, -1 on error, and 0 if the term seems
+   alright, but does not fit in the term structure. If it returns 1, the
    index will be incremented, and the term contains the decoded term. */
 
 int ei_decode_ei_term(const char* buf, int* index, ei_term* term)
@@ -111,10 +111,10 @@ int ei_decode_ei_term(const char* buf, int* index, ei_term* term)
 	break;
     case ERL_SMALL_TUPLE_EXT:
 	term->arity = get8(s);
-	break; /*return 0;*/
+	break;
     case ERL_LARGE_TUPLE_EXT:
 	term->arity = get32be(s);
-	break; /*return 0;*/
+	break;
     case ERL_NIL_EXT:
 	term->arity = 0;
 	break;
@@ -123,7 +123,7 @@ int ei_decode_ei_term(const char* buf, int* index, ei_term* term)
 	return 0;
     case ERL_LIST_EXT:
 	term->arity = get32be(s);
-	break; /*return 0;*/
+	break;
     case ERL_BINARY_EXT:
 	term->size = get32be(s);
 	return 0;
diff --git a/lib/erl_interface/src/registry/reg_dump.c b/lib/erl_interface/src/registry/reg_dump.c
index 1e640fb506..d2854c10b5 100644
--- a/lib/erl_interface/src/registry/reg_dump.c
+++ b/lib/erl_interface/src/registry/reg_dump.c
@@ -215,6 +215,7 @@ static int mn_send_write(int fd, erlang_pid *mnesia, const char *key, ei_reg_obj
     else ei_encode_long(msgbuf,&index,(long)(obj->val.p));  /* just the pointer */
     break;
   default:
+    if (dbuf) free(dbuf);
     return -1;
   }
 
diff --git a/lib/erl_interface/src/registry/reg_restore.c b/lib/erl_interface/src/registry/reg_restore.c
index 765c3f4314..7bc1c758af 100644
--- a/lib/erl_interface/src/registry/reg_restore.c
+++ b/lib/erl_interface/src/registry/reg_restore.c
@@ -303,6 +303,9 @@ int ei_reg_restore(int fd, ei_reg *reg, const char *mntab)
     if (mn_decode_insert(reg,msgbuf,&index,keybuf)) goto restore_failure;
   }
   
+  if (keybuf) free(keybuf);
+  if (dbuf) free(dbuf);
+
   /* wait for unlink */
   if (mn_unlink(fd)) return -1;
 
@@ -310,8 +313,6 @@ int ei_reg_restore(int fd, ei_reg *reg, const char *mntab)
   ei_hash_foreach(reg->tab,clean_obj);
 
   /* success */
-  if (keybuf) free(keybuf);
-  if (dbuf) free(dbuf);
   return 0;
 
 restore_failure: