[PATCH] posix: Fix stack overflow in wordexp tilde expansion (BZ 34091, CVE-2026-6791)

[Florian Weimer]

* Adhemerval Zanella Netto:

> On 22/04/26 09:46, Florian Weimer wrote:
>> * Adhemerval Zanella:
>> 
>>> +      /* tmpbuf contains both the user and the __getpwnam_r working area.  */
>>>        struct scratch_buffer tmpbuf;
>>>        scratch_buffer_init (&tmpbuf);
>>> +      if (!scratch_buffer_set_array_size (&tmpbuf, userlen + 1, 1))
>>> +	return WRDE_NOSPACE;
>>> +      char *user = tmpbuf.data;
>>> +      memcpy (user, &words[1 + *offset], userlen);
>>> +      user[userlen] = '\0';
>>>  
>>> +      struct passwd pwd, *tpwd;
>>> +      int result;
>>> +      while ((result = __getpwnam_r (user,
>>> +				     &pwd,
>>> +				     tmpbuf.data + userlen + 1,
>>> +				     tmpbuf.length - userlen - 1,
>>> +				     &tpwd)
>> 
>> While this is technically correct, this looks like a bit of overkill.
>> Maybe just use __strndup?  There is no reason to optimize this with an
>> on-stack allocation.
>
> It keeps the same performance characteristic and is one less buffer to manage
> (cleanup is done exclusive by scratch_buffer_free). 

The cost is that it turns a standard _r retry loop into a non-standard
one.

I don't have a strong opinion about this.  I hope to get rid of internal
use of those _r functions eventually, at which point we can switch this
to strndup.

Thanks,
Florian