summaryrefslogtreecommitdiff
path: root/regress
diff options
context:
space:
mode:
authorTodd C. Miller <millert@cvs.openbsd.org>2017-05-17 18:07:04 +0000
committerTodd C. Miller <millert@cvs.openbsd.org>2017-05-17 18:07:04 +0000
commitd08590301ef618ae0f92820f480060fe3ef981bb (patch)
tree962c9f1da9f5f2dd5c49905658223e2d4121bcd3 /regress
parent91bd9d3334fb89fca4a857eaaa2c55b108f877a8 (diff)
Add "killer" input from "algorithmic complexity attacks and libc
qsort()". This causes quadratic behavior with the 4.4BSD qsort's "switch to insertion sort" optimization when the input appears to be mostly sorted. That optimization was removed in qsort.c r1.12 but it is worth having in the regress test too.
Diffstat (limited to 'regress')
-rw-r--r--regress/lib/libc/qsort/qsort_test.c12
1 files changed, 12 insertions, 0 deletions
diff --git a/regress/lib/libc/qsort/qsort_test.c b/regress/lib/libc/qsort/qsort_test.c
index f78137504a2..b23f3e61905 100644
--- a/regress/lib/libc/qsort/qsort_test.c
+++ b/regress/lib/libc/qsort/qsort_test.c
@@ -24,6 +24,8 @@
/*
* Test program based on Bentley & McIlroy's "Engineering a Sort Function".
* Uses heapsort(3) to check the results.
+ * The "killer" input is from:
+ * http://calmerthanyouare.org/2014/06/11/algorithmic-complexity-attacks-and-libc-qsort.html
*/
enum distribution {
@@ -32,6 +34,7 @@ enum distribution {
STAGGER,
PLATEAU,
SHUFFLE,
+ KILLER,
INVALID
};
@@ -106,6 +109,15 @@ fill_test_array(int *x, int n, int dist, int m)
case SHUFFLE:
x[i] = arc4random_uniform(m) ? (j += 2) : (k += 2);
break;
+ case KILLER:
+ k = n / 2;
+ if (i < k)
+ x[i] = k - i;
+ else if (i > k)
+ x[i] = n + k + 1 - i;
+ else
+ x[i] = k + 1;
+ break;
default:
err(1, "unexpected distribution %d", dist);
}