From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <gcc-bugzilla@gcc.gnu.org>
Received: by sourceware.org (Postfix, from userid 48)
	id CAF533858D38; Wed, 27 Dec 2023 23:04:20 +0000 (GMT)
DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org CAF533858D38
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gcc.gnu.org;
	s=default; t=1703718260;
	bh=s+b7tDoXK2IlGvcp6Q22PnMybUDxlNwZ4yRZOhPpzwg=;
	h=From:To:Subject:Date:From;
	b=s6WvkZ7jtfHNaHcahjT7FPHbVoKQTodP/SvGMQ6mBMdm7KGQ2XQuK5C178vwHSWHr
	 72g6q1NcQmJWqOV1fY4/TA2dzJThLihpQFnkXyswZj4CSQS5/4B5zNUaR2tj+GN5U1
	 E3JmUGYIRKpjOa0vprlp8U5UXa/uRHp/Y6ms6VIg=
From: "jengelh at inai dot de" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug libstdc++/113159] New: More robust std::sort for silly
 comparator functions
Date: Wed, 27 Dec 2023 23:04:20 +0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: new
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: libstdc++
X-Bugzilla-Version: 14.0
X-Bugzilla-Keywords: 
X-Bugzilla-Severity: normal
X-Bugzilla-Who: jengelh at inai dot de
X-Bugzilla-Status: UNCONFIRMED
X-Bugzilla-Resolution: 
X-Bugzilla-Priority: P3
X-Bugzilla-Assigned-To: unassigned at gcc dot gnu.org
X-Bugzilla-Target-Milestone: ---
X-Bugzilla-Flags: 
X-Bugzilla-Changed-Fields: bug_id short_desc product version bug_status
 bug_severity priority component assigned_to reporter target_milestone
Message-ID: <bug-113159-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
List-Id: <gcc-bugs.sourceware.org>

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=3D113159

            Bug ID: 113159
           Summary: More robust std::sort for silly comparator functions
           Product: gcc
           Version: 14.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: libstdc++
          Assignee: unassigned at gcc dot gnu.org
          Reporter: jengelh at inai dot de
  Target Milestone: ---

Type: enhancement
Version: 13.2.1 20231130 [revision 741743c028dc00f27b9c8b1d5211c1f602f2fddd]
(SUSE Linux) x86_64

Input:

#include <algorithm>
#include <cstdlib>
#include <vector>
int main()
{
        std::vector<int> v(256);
        sort(v.begin(), v.end(), [](int a, int b) -> bool { return rand() &=
 1;
});
        // alternatively, { return true; }
        //
        // -D_GLIBCXX_DEBUG can diagnose obviously-broken cases like
        // {return true;}, but won't necessarily for
        // rand()&1 at all times.
}

Observed output:

<SIGSEGV>

Expected output:

Though I recognize this is undefined behavior, I would love to see the
implementation not run into an out-of-bounds access. glibc's qsort for exam=
ple
stays within the array bounds even if given a buggy comparator like that.=