Out-of-bounds read and write in glibc's qsort()

> we started to readthe glibc's qsort() implementation; to our great surprise, we discovered that the glibc's qsort() is not, in fact, a quick sort by default, but a merge sort (in stdlib/msort.c).