https://gcc.gnu.org/g:c1f32b67510f6f9998deadaef5090b6663adb979
commit r17-5737-gc1f32b67510f6f9998deadaef5090b6663adb979 Author: Jonathan Wakely <[email protected]> Date: Wed Oct 21 18:14:33 2026 +0100 libstdc++: Fix buffer overrun in __gnu_parallel search (CVE-2026-114690) The libstdc++ Parallel Mode (enabled by _GLIBCXX_PARALLEL or by including the relevant headers and calling the functionss explicitly) uses the Knuth-Morris-Pratt search algorithm. A VLA is declared for the borders, but it uses N elements not N+1, leading to an out-of-bounds write in the parallel std::search. libstdc++-v3/ChangeLog: * include/parallel/search.h (__search_template): Increase array size. Reviewed-by: Tomasz Kamiński <[email protected]> Diff: --- libstdc++-v3/include/parallel/search.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libstdc++-v3/include/parallel/search.h b/libstdc++-v3/include/parallel/search.h index f055c5b18b54..34bd51619c38 100644 --- a/libstdc++-v3/include/parallel/search.h +++ b/libstdc++-v3/include/parallel/search.h @@ -111,7 +111,7 @@ namespace __gnu_parallel (1, std::min<_DifferenceType>(__input_length, __get_max_threads())); - _DifferenceType __advances[__pattern_length]; + _DifferenceType __advances[__pattern_length + 1]; __calc_borders(__begin2, __pattern_length, __advances); # pragma omp parallel num_threads(__num_threads)
