[Bug glob/33814] wordexp with WRDE_REUSE and WRDE_APPEND may return uninitialized memory

[cvs-commit at gcc dot gnu.org]

https://sourceware.org/bugzilla/show_bug.cgi?id=33814

--- Comment #3 from Sourceware Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Adhemerval Zanella
<azanella@sourceware.org>:

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=80cc58ea2de214f85b0a1d902a3b668ad2ecb302

commit 80cc58ea2de214f85b0a1d902a3b668ad2ecb302
Author: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Date:   Thu Jan 15 10:32:19 2026 -0300

    posix: Reset wordexp_t fields with WRDE_REUSE (CVE-2025-15281 / BZ 33814)

    The wordexp fails to properly initialize the input wordexp_t when
    WRDE_REUSE is used. The wordexp_t struct is properly freed, but
    reuses the old wc_wordc value and updates the we_wordv in the
    wrong position.  A later wordfree will then call free with an
    invalid pointer.

    Checked on x86_64-linux-gnu and i686-linux-gnu.

    Reviewed-by: Carlos O'Donell <carlos@redhat.com>

-- 
You are receiving this mail because:
You are on the CC list for the bug.