Skip to content

binary_to_term reductions occurs system crash. #11404

Closed

Description

@gbember

Describe the bug
binary_to_term/1 trap after HeapFactory preallocation corrupts the off-heap list and crashes in sweep_off_heap

To Reproduce

Decode = fun() ->
        Bin = <<0,0,0,203,0,10,131,110,6,0,8,0,0,0,128,150,2,90,0,0,0,2,1,159,167,171,92,253,0,0,0,175,131,104,69,100,0,7,97,99,99,111,117,110,116,107,0,16,114,111,98,111,116,50,56,56,49,64,122,116,116,101,115,116,97,0,97,0,98,106,104,93,5,97,0,98,106,104,93,5,97,0,108,0,0,0,1,110,6,0,5,0,0,0,128,150,106,106,104,4,97,127,97,0,97,0,97,1,97,0,106,106,106,106,106,106,106,106,106,106,97,0,106,107,0,9,114,111,98,111,116,50,56,56,49,106,106,97,0,97,0,97,0,106,97,0,106,106,106,106,106,97,1,106,106,106,106,106,106,97,0,97,0,107,0,3,48,46,48,106,97,0,106,97,1,106,106,106,97,0,97,0,104,2,97,0,97,0,97,0,106,97,0,97,0,97,0,106,106,97,0,106,97,0,97,0,106,154,222,49,92,78>>,
        Ls = lists:seq(1, 100000),
        lists:map(fun(_) ->
            <<Size:32, Block:Size/binary, _Rest/binary>> = Bin,
            case Block of
                <<0:16, _/binary>> ->
                    ok;
                <<KSize:16, K:KSize/binary, _Mark:16, Vsn:32, Time:48, VSize:32, V:VSize/binary, _/binary>> ->
                    {binary_to_term(K), binary_to_term(V), Vsn, Time}
            end
        end, Ls),
        io:format("====done====~p~n", [self()])
    end,
    [spawn(Decode) || _ <- lists:seq(1, 30)].

Expected behavior
print 30 line: ====done====

Affected versions
Versions 26.2.5.15 and above of Erlang/OTP all have

otp_binary_to_term_trap_crash_issue.md

Activity

  1. gbember commented on Jul 30, 2026

    @gbember
    Author
    Image
  2. sverker commented on Aug 12, 2026

    @sverker
    Contributor

    Fix #11425 merged to maint for OTP 29.1. Also planned for patches on 27 and 28.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

bugIssue is reported as a bugteam:VMAssigned to OTP team VM

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions