You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Fix undefined behavior in qsort comparison functions for rv_histogram
The freq variable is of type size_t, but the qsort comparison functions
were directly returning a->freq - b->freq, which implicitly converts
the result to an int. This conversion can cause overflow, leading to
implementation-defined behavior.
When freq values are sufficiently large, this issue may violate the
antisymmetric and transitive properties required for comparison
functions:
Antisymmetry: If a < b, then b > a.
Transitivity: If a < b and b < c, then a < c.
Violating these properties results in undefined behavior in qsort,
which could trigger memory corruption in some glibc implementations,
posing a potential security risk. [1]
Rewrite the comparison functions (cmp_dec and cmp_asc) to compare
size_t values explicitly, ensuring correctness and avoiding overflow.
Link: https://www.qualys.com/2024/01/30/qsort.txt [1]
0 commit comments