Last-Update: 2020-03-17
Bug-Debian: https://bugs.debian.org/954127
The type of v->n is size_t, which is an unsigned type, and we are assigning
v->n - 1 to i and looping while this is >= 0. If v->n == 0, on some
architectures (armhf) this results in i being set to a positive value
(specifically, UINT32_MAX).
Gbp-Pq: Name ensure-signed-comparison.patch
for (j = 0; j < 2; ++j) {
sum_n = sum_l = 0;
- for (i = v->n - 1; i >= 0; --i) {
+ for (i = (int64_t)v->n - 1; i >= 0; --i) {
const magv_t *p = &v->a[srt[i]<<32>>32];
int tmp1, tmp2;
tmp1 = tmp2 = 0;