Hitting a known bug in mscl libc

[John Dallman]

We have a test case that hangs in qsort from the WEBASM C runtime when the number of elements in the array exceeds 11405773. This isn’t just any number: it’s the 33rd Leonardo number L(33), a sequence at the heart of the Smoothsort algorithm [1, 2] which musl uses to implement qsort.

In 0.7.10 <= version <= 1.2.6 there’s an issue [3] identified on 10-Apr-2026 where stack corruption occurs if the number of elements to sort exceeds the prior Leonardo number L(32) = 7049155 on 32-bit platforms. (The same happens at L(64) on 64-bit platforms, but this is so big we don’t have to worry about it.) A patch [4] is available but there’s no 1.2.7 release yet.

1. https://en.wikipedia.org/wiki/Leonardo_number
2. https://oeis.org/A001595
3. https://www.sentinelone.com/vulnerability-database/cve-2026-40200/
4. https://www.openwall.com/lists/musl/2026/04/10/3/1

Would it be possible to get a new release of Emscripten with the patched mscl?

Thanks very much,

John Dallman 

[Mike]

• Short answer is: 
• How to protect your Emscripten build
  1. Use std::sort instead of qsort: The C++ standard template library (std::sort) uses an entirely different algorithm (Introsort, a hybrid of Quicksort, Heapsort, and Insertion Sort) and does not use musl's flawed smoothsort primitives. It is completely immune to this CVE.
  2. Cap your input sizes: If you must use qsort on a wasm32 target, implement strict validation to ensure no user-controlled data can feed more than 7 million elements into a single sort call.

--
You received this message because you are subscribed to the Google Groups "emscripten-discuss" group.
To unsubscribe from this group and stop receiving emails from it, send an email to emscripten-disc...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/emscripten-discuss/CAH1xqgkxYUyceur7EGdbMjjZ2EA_i%3Dy7wLDb8nKgDObQnP-rog%40mail.gmail.com.

[Sam Clegg]

This was already patched in https://github.com/emscripten-core/emscripten/pull/27029

This change was part of the recent 6.0.4 release a few days ago.

cheers,

sam

To view this discussion visit https://groups.google.com/d/msgid/emscripten-discuss/CACD-exv0UzPQW_HQaQv88cfT7d69iX%3D0jTMhWUaCysVQpjf0WQ%40mail.gmail.com.

[John Dallman]

Sadly, the code is C, not C++. The C is generated from a domain-specific language that is not at all like C++. That's why we asked for an Emscripten update. 

John

To view this discussion visit https://groups.google.com/d/msgid/emscripten-discuss/CAL_va2-xybTiiyr-_Tjg49it%3DkM6KWL-qopfv3onL2p2VvQVvg%40mail.gmail.com.

[John Dallman]

Oh, excellent. I'll download that. 

Thanks, 

John

On Mon, Jul 27, 2026 at 5:35 PM 'Sam Clegg' via emscripten-discuss <emscripte...@googlegroups.com> wrote:

To view this discussion visit https://groups.google.com/d/msgid/emscripten-discuss/CAL_va2-xybTiiyr-_Tjg49it%3DkM6KWL-qopfv3onL2p2VvQVvg%40mail.gmail.com.

[John Dallman]

And the test now works.

Thanks!

John