From 5374a6d584b8598511f7880b4e64ee52ee1f0cc5 Mon Sep 17 00:00:00 2001 From: Joshua Rogers Date: Tue, 21 Apr 2026 18:11:39 +0200 Subject: [PATCH] buffers: fix handshake_compare when sequence numbers match The comparator function used for ordering DTLS packets by sequence numbers did not follow qsort comparator contracts in case of packets with duplicate sequence numbers, which could lead to unstable ordering or undefined behaviour. Returning 0 in such cases makes the sorting stable. Reported-by: Joshua Rogers of AISLE Research Team Fixes: #1848 Fixes: CVE-2026-42009 Fixes: GNUTLS-SA-2026-04-29-2 CVSS: 7.5 High CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE: CVE-2026-42009 Upstream-Status: Backport [https://gitlab.com/gnutls/gnutls/-/commit/f341441fad91142897d83b44a175ffc8f925b76f] Signed-off-by: Joshua Rogers (cherry picked from commit f341441fad91142897d83b44a175ffc8f925b76f) Signed-off-by: Deepak Rathore --- lib/buffers.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/lib/buffers.c b/lib/buffers.c index e7f08b5625..1ac27e4e96 100644 --- a/lib/buffers.c +++ b/lib/buffers.c @@ -844,11 +844,7 @@ static int handshake_compare(const void *_e1, const void *_e2) { const handshake_buffer_st *e1 = _e1; const handshake_buffer_st *e2 = _e2; - - if (e1->sequence <= e2->sequence) - return 1; - else - return -1; + return (e1->sequence < e2->sequence) - (e1->sequence > e2->sequence); } #define SSL2_HEADERS 1 -- 2.51.0