1From 527aa84bb47dda0da09432d05caca0fd94cee692 Mon Sep 17 00:00:00 2001
 2From: Luca Kellermann <mailto.luca.kellermann@gmail.com>
 3Date: Fri, 10 Apr 2026 03:03:22 +0200
 4Subject: [PATCH] qsort: fix shift UB in shl and shr
 5
 6if shl() or shr() are called with n==8*sizeof(size_t), n is adjusted
 7to 0. the shift by (sizeof(size_t) * 8 - n) that then follows will
 8consequently shift by the width of size_t, which is UB and in practice
 9produces an incorrect result.
10
11return early in this case. the bitvector p was already shifted by the
12required amount.
13---
14 src/stdlib/qsort.c | 2 ++
15 1 file changed, 2 insertions(+)
16
17diff --git a/src/stdlib/qsort.c b/src/stdlib/qsort.c
18index e4bce9f7..28607450 100644
19--- a/src/stdlib/qsort.c
20+++ b/src/stdlib/qsort.c
21@@ -71,6 +71,7 @@ static inline void shl(size_t p[2], int n)
22 		n -= 8 * sizeof(size_t);
23 		p[1] = p[0];
24 		p[0] = 0;
25+		if (!n) return;
26 	}
27 	p[1] <<= n;
28 	p[1] |= p[0] >> (sizeof(size_t) * 8 - n);
29@@ -83,6 +84,7 @@ static inline void shr(size_t p[2], int n)
30 		n -= 8 * sizeof(size_t);
31 		p[0] = p[1];
32 		p[1] = 0;
33+		if (!n) return;
34 	}
35 	p[0] >>= n;
36 	p[0] |= p[1] << (sizeof(size_t) * 8 - n);
37-- 
382.49.0
39