> Note that this can only be exploited if the program is already using a nontransitive comparision function, which is an egregious bug The example they give is

> Note that this can only be exploited if the program is already using a nontransitive comparision function, which is an egregious bug The example they give is "a function cmp(int a, int b) that returns (a - b)", which is definitely a comparison function I've seen before. It's wrong because of overflow, but it's not egregiously wrong. I think it's more significant than you're implying. I wouldn't be surprised if it were used as a step in an exploit chain somewhere in the wild.