[PATCH] posix: Fix stack overflow in wordexp tilde expansion (BZ 34091, CVE-2026-6791)

[Florian Weimer]

* Adhemerval Zanella:

> +      /* tmpbuf contains both the user and the __getpwnam_r working area.  */
>        struct scratch_buffer tmpbuf;
>        scratch_buffer_init (&tmpbuf);
> +      if (!scratch_buffer_set_array_size (&tmpbuf, userlen + 1, 1))
> +	return WRDE_NOSPACE;
> +      char *user = tmpbuf.data;
> +      memcpy (user, &words[1 + *offset], userlen);
> +      user[userlen] = '\0';
>  
> +      struct passwd pwd, *tpwd;
> +      int result;
> +      while ((result = __getpwnam_r (user,
> +				     &pwd,
> +				     tmpbuf.data + userlen + 1,
> +				     tmpbuf.length - userlen - 1,
> +				     &tpwd)

While this is technically correct, this looks like a bit of overkill.
Maybe just use __strndup?  There is no reason to optimize this with an
on-stack allocation.

Thanks,
Florian