Re: [PATCH v2] posix: Fix wordexp WRDE_APPEND to preserve state on non-NOSPACE errors (BZ 34090, CVE-2026-6368)
Andreas Schwab <[email protected]>
| Newsgroups | gmane.comp.lib.glibc.alpha |
|---|---|
| Message-ID | <[email protected]> |
On Jul 13 2026, Adhemerval Zanella wrote:
> @@ -2258,6 +2265,23 @@ wordexp (const char *words, wordexp_t *pwordexp, int flags)
> pwordexp->we_offs = 0;
> }
> }
> + else if (pwordexp->we_wordv != NULL)
> + {
> + /* WRDE_APPEND with an existing word list: duplicate the array so that
> + realloc during parsing does not invalidate the caller's pointer. The
> + strings themselves are shared. */
> + size_t num_p;
> + char **dup;
> + if (INT_ADD_WRAPV (pwordexp->we_offs, pwordexp->we_wordc, &num_p)
> + || INT_ADD_WRAPV (num_p, 1, &num_p))
> + return WRDE_NOSPACE;
This can never happen, since it is exactly the size of the array to
duplicate.
--
Andreas Schwab, SUSE Labs, [email protected]
GPG Key fingerprint = 0196 BAD8 1CE9 1970 F4BE 1748 E4D4 88E3 0EEA B9D7
"And now for something completely different."