AtomVM icon indicating copy to clipboard operation
AtomVM copied to clipboard

binary_to_term can crash on malformed binaries

Open fadushin opened this issue 3 years ago • 0 comments

The binary_to_term function takes a binary and returns an Erlang term.

The current implementation of this function can crash the VM (SEGV) with a properly crafted binary (instead of throwing a badarg exception). We need to perform range checking on prefix-length encodings to ensure that we do not read off the contents of the buffer holding binary data.

This is a potential security issue if binaries are exchanged between VMs (e.g., via TCP)

fadushin avatar Mar 29 '22 02:03 fadushin