From c7d0c3540f192c7dcc0b378650257c065fa4808f Mon Sep 17 00:00:00 2001 From: Kuan-Wei Chiu Date: Wed, 25 Dec 2024 03:16:22 +0800 Subject: [PATCH] Fix undefined behavior in dsortf comparison function In the dsortf function, when both (*e1)->name[0] == '/' and (*e2)->name[0] == '/', a situation occurs where a < b but b < a, violating the transitivity requirement for comparison functions used by qsort as specified by the C standard. This leads to undefined behavior, which can cause incorrect sorting and memory corruption in glibc's qsort implementation, creating a potential security issue [1]. Fix the issue by returning 0 when both entries begin with '/', preventing the undefined behavior. [1] https://www.qualys.com/2024/01/30/qsort.txt --- modules/generators/mod_autoindex.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/modules/generators/mod_autoindex.c b/modules/generators/mod_autoindex.c index 3cafd44b0c6..7267bad1252 100644 --- a/modules/generators/mod_autoindex.c +++ b/modules/generators/mod_autoindex.c @@ -1925,6 +1925,9 @@ static int dsortf(struct ent **e1, struct ent **e2) * First, see if either of the entries is for the parent directory. * If so, that *always* sorts lower than anything else. */ + if ((*e1)->name[0] == '/' && (*e2)->name[0] == '/') { + return 0; + } if ((*e1)->name[0] == '/') { return -1; }