diff options
| author | Rich Felker <dalias@aerifal.cx> | 2026-04-09 22:51:30 -0400 |
|---|---|---|
| committer | Rich Felker <dalias@aerifal.cx> | 2026-04-09 22:51:30 -0400 |
| commit | 228da39e38c1cae13cbe637e771412c1984dba5d (patch) | |
| tree | 0033fc4727c120456cbb2a929d33a534f92a465e /src/stdio/fgetpos.c | |
| parent | d2f20c49dfb556d9096251aa0acd92ca907b3400 (diff) | |
| download | musl-228da39e38c1cae13cbe637e771412c1984dba5d.tar.gz | |
qsort: fix leonardo heap corruption from bug in doubleword ctz primitive
the pntz function, implementing a "count trailing zeros" variant for a
bit vector consisting of two size_t words, erroneously returned zero
rather than the number of bits in the low word when the first bit set
was the low bit of the high word.
as a result, a loop in the trinkle function which should have a
guaranteed small bound on the number of iterations, could run
unboundedly, thereby overflowing a stack-based working-space array
which was sized for the bound.
CVE-2026-40200 has been assigned for this issue.
Diffstat (limited to 'src/stdio/fgetpos.c')
0 files changed, 0 insertions, 0 deletions