[bug #59624] Buffer overflow in gsl_stats_quantile_from_sorted_data

[Patrick Alken]

Follow-up Comment #1, bug #59624 (project gsl):

from msunet =at= shellblade =dot= net

This one is a "fix" for bug 59624, simply checking that |f| is in the expected
range.
Though I don't think there is ultimately a way to check in C whether the
given
array has the right size, so a buggy application can still trigger the bug
described in the email thread.

---
 statistics/quantiles_source.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/statistics/quantiles_source.c b/statistics/quantiles_source.c
index e2956d9d..bf93a1a3 100644
--- a/statistics/quantiles_source.c
+++ b/statistics/quantiles_source.c
@@ -17,6 +17,7 @@
  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
USA.
  */
 
+#include <assert.h>
 
 double
 FUNCTION(gsl_stats,quantile_from_sorted_data) (const BASE sorted_data[], 
@@ -24,6 +25,8 @@ FUNCTION(gsl_stats,quantile_from_sorted_data) (const BASE
sorted_data[],
                                                const size_t n,
                                                const double f)
 {
+  assert(0.0 <= f && f <= 1.0);
+
   const double index = f * (n - 1) ;
   const size_t lhs = (int)index ;
   const double delta = index - lhs ;
-- 
2.27.0



    _______________________________________________________

Reply to this item at:

  <https://savannah.gnu.org/bugs/?59624>

_______________________________________________
  Message sent via Savannah
  https://savannah.gnu.org/