[Bug 213922] crafted data could cause qsort to exhaust stack space

bugzilla-noreply at freebsd.org bugzilla-noreply at freebsd.org
Thu Dec 29 21:16:05 UTC 2016


https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=213922

--- Comment #3 from jhoward at alumni.utexas.net ---
Unfortunately I don't have a working FreeBSD environment to use.  This patch
came about because I pulled down the qsort code for a separate project (just
needed a good implementation to tinker with) and noticed the potential for the
recursion to be exploited using crafted sort data.

Can you point me to a reference on how to run the tests you mentioned?

I'll work on finding a FreeBSD VM I can use, and/or code to generate sort data
that breaks the existing qsort implementation.  That at least proves there's an
issue.

Since the kernel also uses the same implementation, if someone could find a way
to pass crafted sort data to the kernel version, I'd imagine there could be
security implications.

-- 
You are receiving this mail because:
You are the assignee for the bug.


More information about the freebsd-bugs mailing list