From 26a1180cd1521e4c438ac95a57b134e27ea0a72d Mon Sep 17 00:00:00 2001 From: Faraz Vahedi Date: Tue, 2 Jun 2026 12:42:59 +0330 Subject: [PATCH] qsort.3: Document mergesort() behaviour on size overflow Signed-off-by: Faraz Vahedi Pull Request: https://github.com/freebsd/freebsd-src/pull/2243 Reviewed by: fuz MFC after: 1 week --- lib/libc/stdlib/qsort.3 | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/lib/libc/stdlib/qsort.3 b/lib/libc/stdlib/qsort.3 index e2e29e7cf04..6b09d57524b 100644 --- a/lib/libc/stdlib/qsort.3 +++ b/lib/libc/stdlib/qsort.3 @@ -29,7 +29,7 @@ .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF .\" SUCH DAMAGE. .\" -.Dd October 25, 2024 +.Dd June 2, 2026 .Dt QSORT 3 .Os .Sh NAME @@ -362,13 +362,21 @@ functions succeed unless: .It Bq Er EINVAL The .Fa size -argument is zero, or, +argument is zero, the .Fa size argument to .Fn mergesort is less than -.Dq "sizeof(void *) / 2" . +.Dq "sizeof(void *) / 2" , +or +the +.Fa nmemb +and +.Fa size +arguments to +.Fn mergesort +describe an unrepresentable buffer size. .It Bq Er ENOMEM The .Fn heapsort