From: GNU Libc Maintainers <debian-glibc@lists.debian.org>
Date: Wed, 30 Apr 2025 01:01:35 +0000 (+0800)
Subject: local-qsort-memory-corruption
X-Git-Tag: archive/raspbian/2.31-13+rpi1+deb11u12^2~3
X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=92a356fdb5f21daa59ccee6e8309b97550a7c91b;p=glibc.git

local-qsort-memory-corruption


Gbp-Pq: Topic any
Gbp-Pq: Name local-qsort-memory-corruption.patch
---

diff --git a/stdlib/qsort.c b/stdlib/qsort.c
index 4f78bf515..7928b6069 100644
--- a/stdlib/qsort.c
+++ b/stdlib/qsort.c
@@ -225,7 +225,8 @@ _quicksort (void *const pbase, size_t total_elems, size_t size,
     while ((run_ptr += size) <= end_ptr)
       {
 	tmp_ptr = run_ptr - size;
-	while ((*cmp) ((void *) run_ptr, (void *) tmp_ptr, arg) < 0)
+	while (tmp_ptr != base_ptr
+	       && (*cmp) ((void *) run_ptr, (void *) tmp_ptr, arg) < 0)
 	  tmp_ptr -= size;
 
 	tmp_ptr += size;