#776671 glibc: integer overflow in bsearch(3)

Package:
src:glibc
Source:
glibc
Submitter:
Jakub Wilk
Date:
2015-01-31 22:09:09 UTC
Severity:
normal
#776671#3
Date:
2015-01-30 21:30:37 UTC
From:
To:
The way bsearch() computes indices is subject to integer overflow. This
should be only a problem on 32-bit systems, where it's possible to
allocate more than SIZE_MAX/2 bytes of memory.

The attached patch should fix this bug, but it was only lightly tested.

I also attached test case, which currently loops forever on 32-bit
systems. (Beware that it allocates 3GB of memory. Don't run it on a
system that is short of RAM!)