Out-of-bounds read and write in the glibc's qsort()