Skip to content

<algorithm>: Avoid integer overflow in stable_sort() and ranges::stable_sort for huge inputs on x86 #5677

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Aug 16, 2025
Merged

<algorithm>: Avoid integer overflow in stable_sort() and ranges::stable_sort for huge inputs on x86 #5677

Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
e0e2f57
Avoid overflow in stable_sort.
StephanTLavavej Aug 13, 2025
bf76a60
Expand comments.
StephanTLavavej Aug 15, 2025
06e9b60
Avoid overflow in `_Partition_point_unchecked`.
StephanTLavavej Aug 15, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 14 additions & 6 deletions stl/inc/algorithm
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9223,10 +9223,14 @@ void _Buffered_merge_sort_unchecked(const _BidIt _First, const _BidIt _Last, con
_Chunk <<= 1;
_STD _Chunked_merge_unchecked(_Temp_ptr, _Temp_ptr + _Count, _First, static_cast<ptrdiff_t>(_Chunk),
static_cast<ptrdiff_t>(_Count), _Pred);
_Chunk <<= 1;
if (_Count <= _Chunk) { // if the input would be a single chunk, it's already sorted and we're done
return;

// In general, this is equivalent to `_Chunk <<= 1;` followed by testing `_Count <= _Chunk`,
// except that it doesn't risk overflowing. `(_Count - 1) / 2` correctly handles even/odd _Count.
// We have an early return for small _Count above, so `_Count - 1` is safe to form.
if ((_Count - 1) / 2 < _Chunk) {
return; // if the input would be a single chunk, it's already sorted and we're done
}
_Chunk <<= 1;

// more merges necessary; merge to temporary buffer
_STD _Chunked_merge_unchecked(_First, _Last, _Temp_ptr, _Chunk, _Count, _Pred);
Expand Down Expand Up @@ -9394,10 +9398,14 @@ namespace ranges {
// unconditionally merge elements back into the source buffer
_Chunk_size <<= 1;
_Chunked_merge_common(_Temp_ptr, _Temp_ptr + _Count, _First, _Chunk_size, _Count, _Pred, _Proj);
_Chunk_size <<= 1;
if (_Count <= _Chunk_size) { // if the input would be a single chunk, it's already sorted and we're done
return;

// In general, this is equivalent to `_Chunk_size <<= 1;` followed by testing `_Count <= _Chunk_size`,
// except that it doesn't risk overflowing. `(_Count - 1) / 2` correctly handles even/odd _Count.
// We have an early return for small _Count above, so `_Count - 1` is safe to form.
if ((_Count - 1) / 2 < _Chunk_size) {
return; // if the input would be a single chunk, it's already sorted and we're done
}
_Chunk_size <<= 1;

// more merges necessary; merge to temporary buffer
_Chunked_merge_common(_First, _Last, _Temp_ptr, _Chunk_size, _Count, _Pred, _Proj);
Expand Down