From 33299ece737c635910e358d7e09dd8af6bce1a5d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Magnus=20L=C3=A5ng?= <margnus1@telia.com>
Date: Wed, 2 Dec 2015 14:30:56 +0100
Subject: beam: Fix overflow bug in i_bs_add_jId

The test whether the result would fit in a smallnum could overflow into
a negative number that would fit a smallnum. A test that reproduces the
issue was added to bs_construct_SUITE.
---
 erts/emulator/test/bs_construct_SUITE.erl | 18 ++++++++++++++++--
 1 file changed, 16 insertions(+), 2 deletions(-)

(limited to 'erts/emulator/test/bs_construct_SUITE.erl')

diff --git a/erts/emulator/test/bs_construct_SUITE.erl b/erts/emulator/test/bs_construct_SUITE.erl
index 1afd01e27b..f2bd6c233a 100644
--- a/erts/emulator/test/bs_construct_SUITE.erl
+++ b/erts/emulator/test/bs_construct_SUITE.erl
@@ -29,7 +29,7 @@
 	 mem_leak/1, coerce_to_float/1, bjorn/1,
 	 huge_float_field/1, huge_binary/1, system_limit/1, badarg/1,
 	 copy_writable_binary/1, kostis/1, dynamic/1, bs_add/1,
-	 otp_7422/1, zero_width/1, bad_append/1]).
+	 otp_7422/1, zero_width/1, bad_append/1, bs_add_overflow/1]).
 
 -include_lib("test_server/include/test_server.hrl").
 
@@ -40,7 +40,7 @@ all() ->
      in_guard, mem_leak, coerce_to_float, bjorn,
      huge_float_field, huge_binary, system_limit, badarg,
      copy_writable_binary, kostis, dynamic, bs_add, otp_7422, zero_width,
-     bad_append].
+     bad_append, bs_add_overflow].
 
 groups() -> 
     [].
@@ -925,5 +925,19 @@ append_unit_8(Bin) ->
 append_unit_16(Bin) ->
     <<Bin/binary-unit:16,0:1>>.
 
+%% Produce a large result of bs_add that would fit a smallnum if it was viewed
+%% as signed.
+bs_add_overflow(Config) ->
+    case erlang:system_info(wordsize) of
+	8 ->
+	    {skip, "64-bit architecture"};
+	4 ->
+	    Large = <<0:((1 bsl 30)-1)>>,
+	    {'EXIT',{system_limit,_}} =
+		(catch <<Large/bits, Large/bits, Large/bits, Large/bits,
+			 Large/bits, Large/bits, Large/bits, Large/bits,
+			 Large/bits>>),
+	    ok
+    end.
     
 id(I) -> I.
-- 
cgit v1.2.3