Nontransitive comparison functions lead to out-of-bounds read and write in glibc