public inbox for [email protected]  

help / color / mirror / Atom feed

From: Mats Kindahl <[email protected]>
To: Nathan Bossart <[email protected]>
Cc: Heikki Linnakangas <[email protected]>
Cc: Tom Lane <[email protected]>
Cc: [email protected]
Subject: Re: glibc qsort() vulnerability
Date: Thu, 8 Feb 2024 12:01:22 +0100
Message-ID: <CA+14427HmRRcPVzWHYTTnq+=ATbx0znqv_87GdC+C9TFqPKB6g@mail.gmail.com> (raw)
In-Reply-To: <20240207205600.GA378707@nathanxps13>
References: <CA+14426g2Wa9QuUpmakwPxXFWG_1FaY0AsApkvcTBy-YfS6uaw@mail.gmail.com>
	<[email protected]>
	<20240206205305.GB3891538@nathanxps13>
	<[email protected]>
	<CA+14425TqyUZ3-O7zYsW6u85yY5diCz-p_TPQ2bZovn-N-fQ9A@mail.gmail.com>
	<[email protected]>
	<20240207205600.GA378707@nathanxps13>

On Wed, Feb 7, 2024 at 9:56 PM Nathan Bossart <[email protected]>
wrote:

> On Wed, Feb 07, 2024 at 08:46:56PM +0200, Heikki Linnakangas wrote:
> > Doesn't hurt to fix the comparison functions, and +1 on using the same
> > pattern everywhere.
>
> I attached a new version of the patch with some small adjustments.  I
> haven't looked through all in-tree qsort() comparators to see if any others
> need to be adjusted, but we should definitely do so as part of this thread.
> Mats, are you able to do this?
>

Sure, I checked them and the only ones remaining are those using int16.
Shall I modify those as well?


> > However, we use our qsort() with user-defined comparison functions, and
> we
> > cannot make any guarantees about what they might do. So we must ensure
> that
> > our qsort() doesn't overflow, no matter what the comparison function
> does.
> >
> > Looking at our ST_SORT(), it seems safe to me.
>
> Cool.
>
> --
> Nathan Bossart
> Amazon Web Services: https://aws.amazon.com
>

view thread (16+ messages)  latest in thread

reply

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: [email protected]
  Cc: [email protected], [email protected], [email protected], [email protected], [email protected]
  Subject: Re: glibc qsort() vulnerability
  In-Reply-To: <CA+14427HmRRcPVzWHYTTnq+=ATbx0znqv_87GdC+C9TFqPKB6g@mail.gmail.com>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox