diff options
author | Christian Brabandt <cb@256bit.org> | 2024-02-09 19:39:14 +0100 |
---|---|---|
committer | Christian Brabandt <cb@256bit.org> | 2024-02-09 19:39:14 +0100 |
commit | e06e43766500ecb4cd1031fa16cf9cbebdb222c1 (patch) | |
tree | 5594099ce9de3e526002cd8601f3e734475f11eb /src/search.c | |
parent | c9e79e52845d51f48f5ea3753a62ab3fe0e40184 (diff) |
patch 9.1.0089: qsort() comparison functions should be transitivev9.1.0089
Problem: qsort() comparison functions should be transitive
Solution: Do not subtract values, but rather use explicit comparisons
Improve qsort() comparison functions
There has been a recent report on qsort() causing out-of-bounds read &
write in glibc for non transitive comparison functions
https://www.qualys.com/2024/01/30/qsort.txt
Even so the bug is in glibc's implementation of the qsort() algorithm,
it's bad style to just use substraction for the comparison functions,
which may cause overflow issues and as hinted at in OpenBSD's manual
page for qsort(): "It is almost always an error to use subtraction to
compute the return value of the comparison function."
So check the qsort() comparison functions and change them to be safe.
closes: #13980
Signed-off-by: Christian Brabandt <cb@256bit.org>
Diffstat (limited to 'src/search.c')
-rw-r--r-- | src/search.c | 16 |
1 files changed, 12 insertions, 4 deletions
diff --git a/src/search.c b/src/search.c index d4baa9192c..eadbcd3d93 100644 --- a/src/search.c +++ b/src/search.c @@ -4908,7 +4908,10 @@ fuzzy_match_str_compare(const void *s1, const void *s2) int idx1 = ((fuzmatch_str_T *)s1)->idx; int idx2 = ((fuzmatch_str_T *)s2)->idx; - return v1 == v2 ? (idx1 - idx2) : v1 > v2 ? -1 : 1; + if (v1 == v2) + return idx1 == idx2 ? 0 : idx1 > idx2 ? 1 : -1; + else + return v1 > v2 ? -1 : 1; } /* @@ -4936,9 +4939,14 @@ fuzzy_match_func_compare(const void *s1, const void *s2) char_u *str1 = ((fuzmatch_str_T *)s1)->str; char_u *str2 = ((fuzmatch_str_T *)s2)->str; - if (*str1 != '<' && *str2 == '<') return -1; - if (*str1 == '<' && *str2 != '<') return 1; - return v1 == v2 ? (idx1 - idx2) : v1 > v2 ? -1 : 1; + if (*str1 != '<' && *str2 == '<') + return -1; + if (*str1 == '<' && *str2 != '<') + return 1; + if (v1 == v2) + return idx1 == idx2 ? 0 : idx1 > idx2 ? 1 : -1; + else + return v1 > v2 ? -1 : 1; } /* |