Out-of-bounds read and write in glibc's qsort()