Merge branch 'maint'

* maint:
  erts: fix out-of-bounds read on distributed priority send of a fragmented message

Author: rickard-green

erts/emulator/beam/erl_proc_sig_queue.c

@@ -6188,8 +6188,10 @@ handle_altact_msg(Process *c_p, ErtsSigRecvTracing *tracing,
                 /* drop faulty encoded external message... */
                 return cnt;
             }
-            cnt += insert_prepared_prio_msg(c_p, tracing, mp, ERL_MESSAGE_TERM(mp),
-                                            token, next_nm_sig);
+            cnt += insert_prepared_prio_msg_attached(c_p, tracing, mp,
+                                                     mp->data.attached,
+                                                     ERL_MESSAGE_TERM(mp), token,
+                                                     next_nm_sig);
         }
         break;
     }

erts/emulator/test/signal_SUITE.erl

@@ -1826,6 +1826,7 @@ priority_messages_order_test(Node) ->
     {priority_messages, true} = proc_info(Rcvr, priority_messages),
 
     {priority_alias, PrioAlias} = receive {priority_alias, _} = PA -> PA end,
+    Large = binary:copy(<<0>>, 1 bsl 20),
 
     {priority_messages, true} = proc_info(Rcvr, priority_messages),
 
@@ -1850,7 +1851,7 @@ priority_messages_order_test(Node) ->
     PrioAlias ! {msg, 6},
     erlang:send(PrioAlias, {prio_msg, 1}, [priority]),
     erlang:send(PrioAlias, {msg, 7}, []),
-    erlang:send(PrioAlias, prio_msg_2, [priority]),
+    erlang:send(PrioAlias, {prio_msg, Large}, [priority]),
     erlang:send(Rcvr, {msg, 8}, [priority]),
     wait_until(fun () -> msg_received(Rcvr, {msg, 8}) end),
     exit_signal(LinkProc4, {link_exit, 2}),
@@ -1868,7 +1869,7 @@ priority_messages_order_test(Node) ->
               {'DOWN', Mon1, process, MonProc1, prio_down_1},
               {'EXIT', Parent, prio_func_exit_1},
               {prio_msg, 1},
-              prio_msg_2,
+              {prio_msg, Large},
               {'EXIT', LinkProc3, {prio_link_exit, 2}},
               {'DOWN', Mon3, process, MonProc3, {prio_down, 2}},