[PATCH] posix: Fix stack overflow in wordexp tilde expansion (BZ 34091, CVE-2026-6791)

[Adhemerval Zanella Netto]

On 22/04/26 09:46, Florian Weimer wrote:
> * Adhemerval Zanella:
> 
>> +      /* tmpbuf contains both the user and the __getpwnam_r working area.  */
>>        struct scratch_buffer tmpbuf;
>>        scratch_buffer_init (&tmpbuf);
>> +      if (!scratch_buffer_set_array_size (&tmpbuf, userlen + 1, 1))
>> +	return WRDE_NOSPACE;
>> +      char *user = tmpbuf.data;
>> +      memcpy (user, &words[1 + *offset], userlen);
>> +      user[userlen] = '\0';
>>  
>> +      struct passwd pwd, *tpwd;
>> +      int result;
>> +      while ((result = __getpwnam_r (user,
>> +				     &pwd,
>> +				     tmpbuf.data + userlen + 1,
>> +				     tmpbuf.length - userlen - 1,
>> +				     &tpwd)
> 
> While this is technically correct, this looks like a bit of overkill.
> Maybe just use __strndup?  There is no reason to optimize this with an
> on-stack allocation.

It keeps the same performance characteristic and is one less buffer to manage
(cleanup is done exclusive by scratch_buffer_free).