Commit 59bf184
committed
Fix undefined behavior in qsort comparison functions for rv_histogram
The freq variable is of type size_t, but the qsort comparison functions
were directly returning a->freq - b->freq, which implicitly converts
the result to an int. This conversion can cause overflow, leading to
implementation-defined behavior.
When freq values are sufficiently large, this issue may violate the
antisymmetric and transitive properties required for comparison
functions:
Antisymmetry: If a < b, then b > a.
Transitivity: If a < b and b < c, then a < c.
Violating these properties results in undefined behavior in qsort,
which could trigger memory corruption in some glibc implementations,
posing a potential security risk. [1]
Rewrite the comparison functions (cmp_dec and cmp_asc) to compare
size_t values explicitly, ensuring correctness and avoiding overflow.
Link: https://www.qualys.com/2024/01/30/qsort.txt [1]1 parent f69d9dd commit 59bf184
1 file changed
+16
-2
lines changed| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
51 | 51 | | |
52 | 52 | | |
53 | 53 | | |
54 | | - | |
| 54 | + | |
| 55 | + | |
| 56 | + | |
| 57 | + | |
| 58 | + | |
| 59 | + | |
| 60 | + | |
| 61 | + | |
55 | 62 | | |
56 | 63 | | |
57 | 64 | | |
58 | 65 | | |
59 | | - | |
| 66 | + | |
| 67 | + | |
| 68 | + | |
| 69 | + | |
| 70 | + | |
| 71 | + | |
| 72 | + | |
| 73 | + | |
60 | 74 | | |
61 | 75 | | |
62 | 76 | | |
| |||
0 commit comments