From eb53a3f0b7a7d6c4d0a877fe71bc0b0ca11d1597 Mon Sep 17 00:00:00 2001 From: Sverker Eriksson Date: Thu, 20 Feb 2014 14:34:41 +0100 Subject: erts: Fix heap overwrite by hipe "trap frames" when GC is disabled by trapping BIFs like term_to_binary and binary_to_term. --- erts/emulator/hipe/hipe_mode_switch.c | 31 ++++++++++++++++++++++++++++--- 1 file changed, 28 insertions(+), 3 deletions(-) (limited to 'erts/emulator/hipe/hipe_mode_switch.c') diff --git a/erts/emulator/hipe/hipe_mode_switch.c b/erts/emulator/hipe/hipe_mode_switch.c index adc8793469..15cdb231a2 100644 --- a/erts/emulator/hipe/hipe_mode_switch.c +++ b/erts/emulator/hipe/hipe_mode_switch.c @@ -184,21 +184,46 @@ void hipe_set_call_trap(Uint *bfun, void *nfun, int is_closure) bfun[-4] = (Uint)nfun; } -static __inline__ void -hipe_push_beam_trap_frame(Process *p, Eterm reg[], unsigned arity) +void hipe_reserve_beam_trap_frame(Process *p, Eterm reg[], unsigned arity) { /* ensure that at least 2 words are available on the BEAM stack */ if ((p->stop - 2) < p->htop) { - DPRINTF("calling gc to increase BEAM stack size"); + DPRINTF("calling gc to reserve BEAM stack size"); p->fcalls -= erts_garbage_collect(p, 2, reg, arity); + ASSERT(!((p->stop - 2) < p->htop)); } p->stop -= 2; + p->stop[0] = NIL; + p->stop[1] = NIL; +} + +static __inline__ void +hipe_push_beam_trap_frame(Process *p, Eterm reg[], unsigned arity) +{ + if (p->flags & F_DISABLE_GC) { + /* Trap frame already reserved */ + ASSERT(p->stop[0] == NIL && p->stop[1] == NIL); + } + else { + if ((p->stop - 2) < p->htop) { + DPRINTF("calling gc to increase BEAM stack size"); + p->fcalls -= erts_garbage_collect(p, 2, reg, arity); + ASSERT(!((p->stop - 2) < p->htop)); + } + p->stop -= 2; + } p->stop[1] = hipe_beam_catch_throw; p->stop[0] = make_cp(p->cp); ++p->catches; p->cp = hipe_beam_pc_return; } +void hipe_unreserve_beam_trap_frame(Process *p) +{ + ASSERT(p->stop[0] == NIL && p->stop[1] == NIL); + p->stop += 2; +} + static __inline__ void hipe_pop_beam_trap_frame(Process *p) { p->cp = cp_val(p->stop[0]); -- cgit v1.2.3