mirror of
https://github.com/vercel-labs/scriptc.git
synced 2026-11-12 02:13:04 +08:00
Chris Tate
229e336382
The gallop searches in the comparator sort held their search bounds in long, which is 32 bits on Windows x64, so a run of more than 2^31 slots gave a truncated bound and the merges could copy outside the array. The bounds are now ptrdiff_t; every other index, length, offset, hint, run length and run-stack entry in the sort was already size_t. Each gallop result is checked against its run length (0 <= k <= length) before any merge uses it, and a result outside the run is an internal error rather than a copy. A new runtime unit test calls gallop and the merge step, through test-only entry points built with SCR_SORT_TEST, at indices past 2^32 and over runs of more than 2^32 slots in a sparse mapping, and checks that an out-of-range gallop result traps.