Andreas Schwab
49ddb84d87
- syslog-buffer-overflow.patch: syslog: Fix heap buffer overflow in __vsyslog_internal (CVE-2023-6246, CVE-2023-6779, CVE-2023-6780, bsc#1218863, bsc#1218867, bsc#1218868) - qsort-invalid-cmp.patch: qsort: handle degenerated compare function (bsc#1218866) - Change minimum GCC to 13 OBS-URL: https://build.opensuse.org/request/show/1143041 OBS-URL: https://build.opensuse.org/package/show/Base:System/glibc?expand=0&rev=691
30 lines
1.0 KiB
Diff
30 lines
1.0 KiB
Diff
Index: glibc-2.38/stdlib/qsort.c
|
|
===================================================================
|
|
--- glibc-2.38.orig/stdlib/qsort.c
|
|
+++ glibc-2.38/stdlib/qsort.c
|
|
@@ -136,10 +136,12 @@ _quicksort (void *const pbase, size_t to
|
|
that this algorithm runs much faster than others. */
|
|
do
|
|
{
|
|
- while ((*cmp) ((void *) left_ptr, (void *) mid, arg) < 0)
|
|
+ while (left_ptr != mid
|
|
+ && (*cmp) ((void *) left_ptr, (void *) mid, arg) < 0)
|
|
left_ptr += size;
|
|
|
|
- while ((*cmp) ((void *) mid, (void *) right_ptr, arg) < 0)
|
|
+ while (right_ptr != mid
|
|
+ && (*cmp) ((void *) mid, (void *) right_ptr, arg) < 0)
|
|
right_ptr -= size;
|
|
|
|
if (left_ptr < right_ptr)
|
|
@@ -224,7 +226,8 @@ _quicksort (void *const pbase, size_t to
|
|
while ((run_ptr += size) <= end_ptr)
|
|
{
|
|
tmp_ptr = run_ptr - size;
|
|
- while ((*cmp) ((void *) run_ptr, (void *) tmp_ptr, arg) < 0)
|
|
+ while (tmp_ptr != base_ptr
|
|
+ && (*cmp) ((void *) run_ptr, (void *) tmp_ptr, arg) < 0)
|
|
tmp_ptr -= size;
|
|
|
|
tmp_ptr += size;
|