Skip to content

Add bounds checks in SDL_qsort #10066

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Nov 3, 2025
Merged

Add bounds checks in SDL_qsort #10066

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
211432e
Add bounds checks to SDL_qsort
aikawayataro Jun 20, 2024
5ec61c4
Fix bound check condition in SDL_qsort
aikawayataro Nov 3, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 5 additions & 3 deletions src/stdlib/SDL_qsort.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -333,7 +333,7 @@ typedef struct { char * first; char * last; } stack_entry;
char *test; \
/* Find the right place for |first|. \
* My apologies for var reuse. */ \
for (test=first-size;compare(userdata,test,first)>0;test-=size) ; \
for (test=first-size;test>=(char*)base&&compare(userdata,test,first)>0;test-=size) ; \
test+=size; \
if (test!=first) { \
/* Shift everything in [test,first) \
Expand Down Expand Up @@ -418,6 +418,7 @@ static void qsort_r_nonaligned(void *base, size_t nmemb, size_t size,
while (1) {
/* Select pivot */
{ char * mid=first+size*((last-first)/size >> 1);
if (mid>=last) break;
Pivot(SWAP_nonaligned,size);
memcpy(pivot,mid,size);
}
Expand Down Expand Up @@ -449,6 +450,7 @@ static void qsort_r_aligned(void *base, size_t nmemb, size_t size,
while (1) {
/* Select pivot */
{ char * mid=first+size*((last-first)/size >> 1);
if (mid>=last) break;
Pivot(SWAP_aligned,size);
memcpy(pivot,mid,size);
}
Expand Down Expand Up @@ -484,6 +486,7 @@ fprintf(stderr,"Doing %d:%d: ",
#endif
/* Select pivot */
{ char * mid=first+WORD_BYTES*((last-first) / (2*WORD_BYTES));
if (mid>=last) break;
Pivot(SWAP_words,WORD_BYTES);
*(int*)pivot=*(int*)mid;
#ifdef DEBUG_QSORT
Expand All @@ -506,7 +509,7 @@ fprintf(stderr, "after partitioning first=#%lu last=#%lu\n", (first-(char*)base)
/* Find the right place for |first|. My apologies for var reuse */
int *pl=(int*)(first-WORD_BYTES),*pr=(int*)first;
*(int*)pivot=*(int*)first;
for (;compare(userdata,pl,pivot)>0;pr=pl,--pl) {
for (;pl>=(int*)base&&compare(userdata,pl,pivot)>0;pr=pl,--pl) {
*pr=*pl; }
if (pr!=(int*)first) *pr=*(int*)pivot;
}
Expand Down Expand Up @@ -571,4 +574,3 @@ void *SDL_bsearch(const void *key, const void *base, size_t nmemb, size_t size,
// qsort_non_r_bridge just happens to match calling conventions, so reuse it.
return SDL_bsearch_r(key, base, nmemb, size, qsort_non_r_bridge, compare);
}

Loading