Date: Thu, 8 Feb 2024 12:38:35 -0600
From: Nathan Bossart <nathandbossart@gmail.com>
To: Mats Kindahl <mats@timescale.com>
Cc: Thomas Munro <thomas.munro@gmail.com>,
	Andres Freund <andres@anarazel.de>,
	Heikki Linnakangas <hlinnaka@iki.fi>, Tom Lane <tgl@sss.pgh.pa.us>,
	pgsql-hackers@lists.postgresql.org
Subject: Re: glibc qsort() vulnerability
Message-ID: <20240208183835.GA503311@nathanxps13>
References: <cc9b0272-849a-4a88-8200-59786d18b7a1@iki.fi>
 <20240207214857.rjqkutiaapka2xyp@awork3.anarazel.de>
 <20240207222124.GA382832@nathanxps13>
 <20240208004207.aoyrtv577nmhrivy@awork3.anarazel.de>
 <20240208015211.GA445153@nathanxps13>
 <20240208020637.3irwi5vph4fbxw2f@awork3.anarazel.de>
 <CA+hUKGLbC4O56rtFM69Tx6StT3PcVio9K2GisjZp=z6O20Q3sw@mail.gmail.com>
 <CA+hUKGJaOM5ULeXboxV+fGkU-pYHotL5A10hYxdu8_kwRcVEgQ@mail.gmail.com>
 <20240208025620.GC445153@nathanxps13>
 <CA+14424k0MbdkJuSSLrr1==PYK+oL5Gtq7siTsMgCs+KcCrEvA@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: 
 <CA+14424k0MbdkJuSSLrr1==PYK+oL5Gtq7siTsMgCs+KcCrEvA@mail.gmail.com>
Archived-At: 
 <https://www.postgresql.org/message-id/20240208183835.GA503311%40nathanxps13>
Precedence: bulk

On Thu, Feb 08, 2024 at 02:16:11PM +0100, Mats Kindahl wrote:
> +/*
> + * Compare two integers and return -1, 0, or 1 without risking overflow.
> + *
> + * This macro is used to avoid running into overflow issues because a simple
> + * subtraction of the two values when implementing a cmp function for qsort().
> +*/
> +#define INT_CMP(lhs,rhs) (((lhs) > (rhs)) - ((lhs) < (rhs)))

I think we should offer a few different macros, i.e., separate macros for
int8, uint8, int16, uint16, int32, etc.  For int16, we can do something
faster like

	(int32) (lhs) - (int32) (rhs)

but for int32, we need to do someting more like what's in the patch.

-- 
Nathan Bossart
Amazon Web Services: https://aws.amazon.com