3 ms·
That’s a pretty cool find. It just goes to show even some of the oldest and most widely used open source libraries still have security issues. This is a rare co
by goalieca 3y ago
That’s a pretty cool find. It just goes to show even some of the oldest and most widely used open source libraries still have security issues. This is a rare corner case but it’s still a fantastic find. I suppose no static analysis tools found it over all those years.
- ericdfoley 3y agoThis has always been an issue with sorting float arrays that contain NaN in C or C++ (e.g. with std::sort() with the default "<" comparator.)
- vitiral 3y agowhat has been? OOB errors?
- ericdfoley 3y agoSeg faults
- vitiral 3y agoso... you're saying you've hit this exact bug before? I bet that was a fun debug session!
- charcircuit 3y agoIt's not new. They are just passing in an invalid parameter. If you pass random parameters into a function like memcpy it will do bad stuff too. C APIs were not all designed to be safe to call and can commonly crash or introduce a vulnerability.
- jhallenworld 3y agoI can imagine the future memcpy CVE: "arguments to memcpy to regions not previously allocated or after having been freed can potentially cause security issues. Therefore we propose that memcpy check its arguments against this new list of valid memory addresses that we are now going to keep around..." So what I mean is: how much performance are we giving up with this "fix" for qsort?
- anonymoushn 3y agothe glibc qsort function is already something you only use if you don't care about performance.
- sureglymop 3y agoThen what is a better alternative? I was always told that I shouldn't implement something as trivial as sorting algorithms by myself...
- tokedo 3y agoA simple solution is to create a C++ file and exposing sorting functions to C. E.g. "void sort_int(int *data, size_t n)". The implementation uses then std::sort. Unfortunately, qsort is really slow and sometimes barely usable.
- CyberDildonics 3y agoYou were told correctly, but there is a lot of room between using the C standard library and making your own sort. C++ STL std::sort is one, but the internet is filled with libraries you can download, of course you can find a better alternative with a search.
- SAI_Peregrinus 3y agoARM Morello does that check in hardware.
- MathMonkeyMan 3y agoI've seen a few programs that misbehave due to a comparison function that doesn't have all of the necessary properties. Maybe what's notable from a security perspective is that here's a contract about the behavior of an algorithm (comparison function) as opposed to the value of an argument (null pointer, negative, bigger than N, etc.). Still qualifies as passing an invalid parameter.
- deleted 3y ago[deleted]