Out-of-bounds read and write in the glibc's qsort()

Re:Out-of-bounds read and write in the glibc's qsort() by skitter on Monday February 05, 2024 @02:14PM (#39265602)

I don't think it's undefined behavior though. Looking at (the working draft of) the C ISO standard, I don't see a requirement that the comparison function must be transitive.

The closes thing there is 7.22.5.2 §4: "If two elements compare as equal, their order in the resulting sorted array is unspecified"

So I'd say blaming users for a bug in glibc isn't fair.

[ Parent | on HN ]

Re:Out-of-bounds read and write in the glibc's qsort() by int_19h on Monday February 05, 2024 @02:57PM (#39266244)

In ISO C17, 7.2.5/4 has the relevant verbiage:

"When the same objects (consisting of size bytes, irrespective of their current positions in the array) are passed more than once to the comparison function, the results shall be consistent with one another. That is, for qsort they shall define a total ordering on the array, and for bsearch the same object shall always compare the same way with the key."

[ Parent | on HN ]

Re:Out-of-bounds read and write in the glibc's qsort() by skitter on Monday February 05, 2024 @03:02PM (#39266323)

Thanks! So it is/was indeed UB.

[ Parent | on HN ]