Date: Fri, 24 Jul 2026 16:01:13 -0400
From: Nathan Bossart <nathandbossart@gmail.com>
To: =?utf-8?B?0KXQsNC80LjQtNGD0LvQu9C40L0g0KDRg9GB0YLQsNC8?=
 <r.khamidullin@postgrespro.ru>
Cc: Mats Kindahl <mats@timescale.com>, Andres Freund <andres@anarazel.de>,
	Tom Lane <tgl@sss.pgh.pa.us>, Thomas Munro <thomas.munro@gmail.com>,
	Heikki Linnakangas <hlinnaka@iki.fi>,
	pgsql-hackers@lists.postgresql.org
Subject: Re: glibc qsort() vulnerability
Message-ID: <amPEiUFpt1RNhYBk@nathan>
References: <20240212213130.jp5vwotwazypaaez@awork3.anarazel.de>
 <20240212230423.GA3519@nathanxps13>
 <20240212234134.ilwrxvwyza3vvps7@awork3.anarazel.de>
 <CA+14424WBPAsZDk+yq1dMv=aZeF2ePehv+t9rRMur51-FJc0gA@mail.gmail.com>
 <20240213181044.GA13935@nathanxps13>
 <20240215233219.GA1204090@nathanxps13>
 <CA+144256aiJqpF9M6+82br97hJLMySFReuXxTc_te3aqsZ=ouA@mail.gmail.com>
 <20240216200951.GA1511686@nathanxps13>
 <CA+14424bbhPnWze3PUo0-5smdo8t_1sDLvOsCHM4aRhousf4KQ@mail.gmail.com>
 <5c5a7984-b149-b505-7ad9-2a7766c65b55@postgrespro.ru>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <5c5a7984-b149-b505-7ad9-2a7766c65b55@postgrespro.ru>
Archived-At: <https://www.postgresql.org/message-id/amPEiUFpt1RNhYBk%40nathan>
Precedence: bulk

On Fri, Jul 24, 2026 at 06:12:03PM +0300, Хамидуллин Рустам wrote:
>  static int 
>  db_comparator(const void *a, const void *b) 
>  { 
> -    if (((const avl_dbase *) a)->adl_score == ((const avl_dbase *) b)->adl_score) 
> -        return 0; 
> -    else 
> -        return (((const avl_dbase *) a)->adl_score < ((const avl_dbase *) b)->adl_score) ? 1 : -1; 
> +    return pg_cmp_s32(((const avl_dbase *) a)->adl_score, 
> +                      ((const avl_dbase *) b)->adl_score); 
>  } 
> 
> It breaks the database vacuuming order. The order should clearly be different here. 
> This bug was introduced in PostgreSQL 17. I have attached а fix. 

Oops, I think you're right.  Thanks for reporting.  I'll plan on committing
this sometime next week.

-- 
nathan