Hello,

Nobody uses gwlist_sort() but insect found. So I will describe it and propose
fix for benefit of future generations.

Forementioned function uses qsort(3) like this:

>    qsort(&GET(list, 0), list->len, sizeof(void*), cmp);

And remember this code:

> #define INDEX(list, i)  (((list)->start + i) % (list)->tab_size)
> #define GET(list, i)    ((list)->tab[INDEX(list, i)])

If tab array is wrapped this produces misbehavior. For example if we have
tab_size = 7, len = 7, start = 1 qsort() will try to sort 7 elements starting
from second, which mean it will try to pass into compare function bogus element
past end of tab array, resulting crash or precious software.

This probably should fix the problem:

    // if array is wrapped we need to merge parts into a single chunk
    if ((list->start + list->len) > list->tab_size) {
        if (list->len != list->tab_size)
            memmove(list->tab + INDEX(list, list->len),
                    list->tab + list->start,
                    (list->len - INDEX(list, list->len)) * sizeof(void *));
        list->start = 0;
    }

    qsort(&GET(list, 0), list->len, sizeof(void*), cmp);


Best regards.


Reply via email to