Skip to content

Conversation

filmor
Copy link
Member

@filmor filmor commented Sep 6, 2025

Set ErlNifEntry.min_erts to a placeholder value

This value was introduced with NIF version 2.14 (so, OTP-21, erts-10.0).

Us leaving it unassigned and defaulting to NIF version 2.15 means the OTP is currently always putting a random pointer into the respective field here:

https://github.com/erlang/otp/blob/ae81b2f6ff2d541c01242f12cdbd5238aa4b26bd/erts/emulator/beam/erl_nif.c#L4581-L4585

It is used if one tries to load a NIF library that was compiled for a newer NIF version to display a debug message, at which point it would perform an out-of-bounds read.

As we currently default to NIF v2.15 (OTP-22) and only have features up to 2.16 (OTP-24), there are probably very few cases of this actually occurring in the wild.

This value was introduced with NIF version 2.14 (so, OTP-21, erts-10.0).

Us leaving it unassigned and defaulting to NIF version 2.15 means the OTP is currently
always putting a random pointer into the respective field here:

https://github.com/erlang/otp/blob/ae81b2f6ff2d541c01242f12cdbd5238aa4b26bd/erts/emulator/beam/erl_nif.c#L4581-L4585

It is used if one tries to load a NIF library that was compiled for a
newer NIF version to display a debug message, at which point it would
perform an out-of-bounds read.

As we currently default to NIF v2.15 (OTP-22) and only have features up
to 2.16 (OTP-24), there are probably very few cases of this actually
occurring in the wild.
@filmor filmor merged commit 97e3448 into master Sep 6, 2025
64 checks passed
@filmor filmor deleted the min-erts branch September 9, 2025 12:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant