Re: glibc qsort() vulnerability

Поиск
Список
Период
Сортировка
От Andres Freund
Тема Re: glibc qsort() vulnerability
Дата
Msg-id 20240208195954.vlpoii4ftoow2of4@awork3.anarazel.de
обсуждение исходный текст
Ответ на Re: glibc qsort() vulnerability  (Tom Lane <tgl@sss.pgh.pa.us>)
Ответы Re: glibc qsort() vulnerability  (Nathan Bossart <nathandbossart@gmail.com>)
Список pgsql-hackers
Hi,

On 2024-02-08 13:44:02 -0500, Tom Lane wrote:
> Nathan Bossart <nathandbossart@gmail.com> writes:
> > On Thu, Feb 08, 2024 at 02:16:11PM +0100, Mats Kindahl wrote:
> >> +/*
> >> + * Compare two integers and return -1, 0, or 1 without risking overflow.
> >> + *
> >> + * This macro is used to avoid running into overflow issues because a simple
> >> + * subtraction of the two values when implementing a cmp function for qsort().
> >> +*/
> >> +#define INT_CMP(lhs,rhs) (((lhs) > (rhs)) - ((lhs) < (rhs)))
>
> > I think we should offer a few different macros, i.e., separate macros for
> > int8, uint8, int16, uint16, int32, etc.  For int16, we can do something
> > faster like

+1


> >     (int32) (lhs) - (int32) (rhs)
>
> > but for int32, we need to do someting more like what's in the patch.
>
> Are we okay with using macros that (a) have double evaluation hazards
> and (b) don't enforce the data types being compared are the same?
> I think static inlines might be a safer technology.

+1


I'd put these static inlines into common/int.h. I don't think this is common
enough to warrant being in c.h. Probably also doesn't hurt to have a not quite
as generic name as INT_CMP, I'd not be too surprised if that's defined in some
library.


I think it's worth following int.h's pattern of including [s]igned/[u]nsigned
in the name, an efficient implementation for signed might not be the same as
for unsigned. And if we use static inlines, we need to do so for correct
semantics anyway.


Greetings,

Andres



В списке pgsql-hackers по дате отправления:

Предыдущее
От: Jim Jones
Дата:
Сообщение: Re: Psql meta-command conninfo+
Следующее
От: Alexander Korotkov
Дата:
Сообщение: Re: gcc build warnings at -O3