>From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Luca Kellermann Date: Fri, 10 Apr 2026 03:03:22 +0200 Subject: [PATCH 2/2] qsort: fix shift UB in shl and shr if shl() or shr() are called with n==8*sizeof(size_t), n is adjusted to 0. the shift by (sizeof(size_t) * 8 - n) that then follows will consequently shift by the width of size_t, which is UB and will trigger UBSan. return early in this case. the bitvector p was already shifted by the required amount. --- src/stdlib/qsort.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/stdlib/qsort.c b/src/stdlib/qsort.c index e49e30365849981539f3cb2414284aea95aaf93f..f9431154d2d14493a691162ed106f501f52b2f2f 100644 --- a/src/stdlib/qsort.c +++ b/src/stdlib/qsort.c @@ -65,23 +65,25 @@ static inline void shl(size_t p[2], int n) { if(n >= 8 * sizeof(size_t)) { n -= 8 * sizeof(size_t); p[1] = p[0]; p[0] = 0; + if (!n) return; } p[1] <<= n; p[1] |= p[0] >> (sizeof(size_t) * 8 - n); p[0] <<= n; } static inline void shr(size_t p[2], int n) { if(n >= 8 * sizeof(size_t)) { n -= 8 * sizeof(size_t); p[0] = p[1]; p[1] = 0; + if (!n) return; } p[0] >>= n; p[0] |= p[1] << (sizeof(size_t) * 8 - n); p[1] >>= n; }