File 0825-erts-Fix-potential-integer-overflow-in-ESTACK.patch of Package erlang
From d26eff597c5f4a9a79055e85b8d59fa5f7ca4698 Mon Sep 17 00:00:00 2001
From: Lukas Larsson <lukas@erlang.org>
Date: Fri, 12 Nov 2021 14:00:44 +0100
Subject: [PATCH 2/2] erts: Fix potential integer overflow in ESTACK
If ESTACK_RESERVE is called with a large enough N then
the subtraction would overflow and the stack would not
be grown as it should. As far as I can tell this is never
done so this fix is to protect against future use.
---
erts/emulator/beam/global.h | 30 +++++++++++-------------------
1 file changed, 11 insertions(+), 19 deletions(-)
diff --git a/erts/emulator/beam/global.h b/erts/emulator/beam/global.h
index 3eb0225b4e..9176309e42 100644
--- a/erts/emulator/beam/global.h
+++ b/erts/emulator/beam/global.h
@@ -443,28 +443,29 @@ do { \
#define ESTACK_IS_STATIC(s) ((s).start == ESTK_DEF_STACK(s))
+#define ESTACK_RESERVE(s, push_cnt) \
+do { \
+ if ((s).end - (s).sp < (Sint)(push_cnt)) { \
+ erl_grow_estack(&(s), (push_cnt)); \
+ } \
+} while(0)
+
#define ESTACK_PUSH(s, x) \
do { \
- if ((s).sp == (s).end) { \
- erl_grow_estack(&(s), 1); \
- } \
+ ESTACK_RESERVE(s, 1); \
*(s).sp++ = (x); \
} while(0)
#define ESTACK_PUSH2(s, x, y) \
do { \
- if ((s).sp > (s).end - 2) { \
- erl_grow_estack(&(s), 2); \
- } \
+ ESTACK_RESERVE(s, 2); \
*(s).sp++ = (x); \
*(s).sp++ = (y); \
} while(0)
#define ESTACK_PUSH3(s, x, y, z) \
do { \
- if ((s).sp > (s).end - 3) { \
- erl_grow_estack(&s, 3); \
- } \
+ ESTACK_RESERVE(s, 3); \
*(s).sp++ = (x); \
*(s).sp++ = (y); \
*(s).sp++ = (z); \
@@ -472,22 +473,13 @@ do { \
#define ESTACK_PUSH4(s, E1, E2, E3, E4) \
do { \
- if ((s).sp > (s).end - 4) { \
- erl_grow_estack(&s, 4); \
- } \
+ ESTACK_RESERVE(s, 4); \
*(s).sp++ = (E1); \
*(s).sp++ = (E2); \
*(s).sp++ = (E3); \
*(s).sp++ = (E4); \
} while(0)
-#define ESTACK_RESERVE(s, push_cnt) \
-do { \
- if ((s).sp > (s).end - (push_cnt)) { \
- erl_grow_estack(&(s), (push_cnt)); \
- } \
-} while(0)
-
/* Must be preceded by ESTACK_RESERVE */
#define ESTACK_FAST_PUSH(s, x) \
do { \
--
2.31.1