Re: New GNU C Library (glibc) security flaw reported on 30 Jan 2024

[Florian Weimer <fweimer@redhat.com>]

* Paul Eggert:

> On 2024-04-22 07:39, Zack Weinberg wrote:
>> On Mon, Apr 8, 2024, at 4:28 AM, Florian Weimer wrote:
>>> * Paul Eggert:
>>>>   the same array element should always compare the same way with
>>>>   the key.
>>>
>>> I don't think the requirement described in the last line actually
>>> exists.  Some applications likely reuse the same key object to search
>>> for different values, and the requirement might prohibit that (but it
>>> is ambiguous).
>> I believe what Paul was trying to express here is that *during a
>> single
>> call to bsearch*, repeated calls to the comparison function with the
>> same (key, element) pair should return the same result.
>
> Yes. I was mimicking POSIX, which says:
>
>> When the same objects ... are passed more than once to the comparison function, the results shall be consistent with one another. That is, the same object shall always compare the same way with the key.
>
> Perhaps we should simply remove the word "always" from the glibc
> manual's phrasing? "Always" is not needed, and removing "always"
> should help avoid the unwanted implication that the requirement
> applies even to earlier or later bsearch invocations.

Makes sense, thanks.

Florian