[Bug glob/33814] wordexp with WRDE_REUSE and WRDE_APPEND may return uninitialized memory

[cvs-commit at gcc dot gnu.org]

https://sourceware.org/bugzilla/show_bug.cgi?id=33814

--- Comment #10 from Sourceware Commits <cvs-commit at gcc dot gnu.org> ---
The release/2.37/master branch has been updated by Adhemerval Zanella
<azanella@sourceware.org>:

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=ff2b172803f6bbd897755d2ce83ec4323a1a15b3

commit ff2b172803f6bbd897755d2ce83ec4323a1a15b3
Author: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Date:   Thu Jan 15 10:32:19 2026 -0300

    posix: Reset wordexp_t fields with WRDE_REUSE (CVE-2025-15281 / BZ 33814)

    The wordexp fails to properly initialize the input wordexp_t when
    WRDE_REUSE is used. The wordexp_t struct is properly freed, but
    reuses the old wc_wordc value and updates the we_wordv in the
    wrong position.  A later wordfree will then call free with an
    invalid pointer.

    Checked on x86_64-linux-gnu and i686-linux-gnu.

    Reviewed-by: Carlos O'Donell <carlos@redhat.com>
    (cherry picked from commit 80cc58ea2de214f85b0a1d902a3b668ad2ecb302)

-- 
You are receiving this mail because:
You are on the CC list for the bug.