Segfault with Erlang otp

README.md

Case1 file:pread

• Segfault when invoking file:pread with 3rd args which is larger than 4294967265(about 4GB)
• Code to reproduce this issue

    ./case1.erl 4294967265

• Env

  name | value :----- |:----- cpu |32core memory |32G uname |Linux * 2.6.32-358.6.2.el6.x86_64 #1 SMP Thu May 16 20:59:36 UTC 2013 x86_64 x86_64 x86_64 GNU/Linux Erlang |15B03,16B02,16B03

backtrace

(gdb) bt
#0  bf_link_free_block (allctr=0x7fd2b5e24e00, block=0x7fd2b3d40140)
    at beam/erl_bestfit_alloc.c:726
#1  0x000000000043aa87 in mbc_free (allctr=0x7fd2b5e24e00, 
    p=<value optimized out>, busy_pcrr_pp=0x7fd2addbb888)
    at beam/erl_alloc_util.c:2183
#2  0x000000000043cc3b in erts_alcu_free_thr_pref (type=169, 
    extra=<value optimized out>, p=0x7fd2b3d40148)
    at beam/erl_alloc_util.c:5048
#3  0x00000000004f4dff in erts_free (p=0x7fd2b2480528, fullsweep=0)
    at beam/erl_alloc.h:249
#4  erts_bin_free (p=0x7fd2b2480528, fullsweep=0) at beam/erl_binary.h:307
#5  sweep_off_heap (p=0x7fd2b2480528, fullsweep=0) at beam/erl_gc.c:2309
#6  0x00000000004f5867 in do_minor (p=0x7fd2b2480528, new_sz=1598, objv=0x2, 
    nobj=95898052) at beam/erl_gc.c:1152
#7  0x00000000004f960e in minor_collection (p=0x7fd2b2480528, need=2, 
    objv=<value optimized out>, nobj=<value optimized out>)
    at beam/erl_gc.c:862
#8  erts_garbage_collect (p=0x7fd2b2480528, need=2, 
    objv=<value optimized out>, nobj=<value optimized out>)
    at beam/erl_gc.c:441
#9  0x00000000005331e5 in process_main ()
    at x86_64-unknown-linux-gnu/opt/smp/beam_hot.h:1495
#10 0x0000000000491ca9 in sched_thread_func (vesdp=0x4e16940)
    at beam/erl_process.c:5801
#11 0x000000000059b956 in thr_wrapper (vtwd=0x7fff10b7e640)
    at pthread/ethread.c:106
#12 0x00007fd2b51d9851 in start_thread () from /lib64/libpthread.so.0
#13 0x00007fd2b4d1f90d in clone () from /lib64/libc.so.6

case1.erl

#!/bin/env escript
%% -*- mode: erlang;erlang-indent-level: 4;indent-tabs-mode: nil -*-
%% ex: ft=erlang ts=4 sw=4 et

-define(TEST_FILE_PATH,       "test.dat").
-define(TEST_FILE_SIZE,       8192).

main([]) ->
    io:format(user, "Usage: case1 (read bytes)~n", []);
main([Arg1|_T]) ->
    ReadBytes = list_to_integer(Arg1),
    Data = crypto:rand_bytes(?TEST_FILE_SIZE),
    file:write_file(?TEST_FILE_PATH, Data),
    {ok, IoDev} = file:open(?TEST_FILE_PATH, [read, raw, binary]),
    try
        exec(IoDev, ReadBytes)
    after
        file:close(IoDev)
    end,
    ok.

exec(IoDev, ReadBytes) ->
    Offset = random:uniform(?TEST_FILE_SIZE - 1),
    try
        case file:pread(IoDev, Offset, ReadBytes) of
            {ok, Data} -> {ok, Data};
            eof -> ok;
            {error, Reason} -> 
                io:format(user, "[error] file read error:~p~n", [Reason]),
                exit(Reason)
        end
    after 
        io:format(user, "[info] memory usages:~p~n", [erlang:memory()])
    end.