[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20260410151907.GS1827@brightrain.aerifal.cx>
Date: Fri, 10 Apr 2026 11:19:07 -0400
From: Rich Felker <dalias@...c.org>
To: Luca Kellermann <mailto.luca.kellermann@...il.com>
Cc: Hankins <546824250@...com>, musl@...ts.openwall.com
Subject: Re: qsort core dump with 20,000,000 elements on 32-bit systems
On Fri, Apr 10, 2026 at 05:17:42AM +0200, Luca Kellermann wrote:
> On Thu, Apr 09, 2026 at 03:21:49PM +0800, Hankins wrote:
> > Sorry, I should have described it in more detail.
> > I discovered the issue while testing on a 32-bit system: when the
> > number of elements sorted by qsort exceeds 18454930, a core dump
> > occurs; otherwise, it does not
>
> I was trying to understand musl's qsort() a few weeks ago (by reading
> Keith Schwarz's explanation [1] and Dijkstra's original paper [2]) and
> I found some bugs back then that might explain your issue. I just
> haven't gotten around to reporting them yet but your mail encouraged
> me to do that now :)
>
> Description and fixes of two bugs attached.
>
> Are your 32-bit systems Arm or PowerPC by any chance? If so, see the
> commit message of the first attached patch for where the number
> 18454930 might come from.
Apologies to both of you for not replying sooner. I've been scrambling
to assess the severity and get an advisory out, since the information
already present on the list was sufficient for anyone motivated to
figure out the rest.
This is now CVE-2026-40200 and it is potentially quite serious. I've
credited you both in the announcement.
I already had a patch queued for the pntz part but not for the shift
UB, so I stuck with mine (which also has some further hardening
followup) to fix the former, even if Luca's might be a nicer approach.
I don't really like that the original code or my version has a path to
return 0 for what's an invalid input, so I may revisit this.
Thanks for reporting!
Rich
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
