[PATCH] posix: Fix stack overflow in wordexp tilde expansion (BZ 34091, CVE-2026-6791)

[Adhemerval Zanella Netto]

On 22/04/26 10:07, Florian Weimer wrote:
> * Adhemerval Zanella Netto:
> 
>> On 22/04/26 09:46, Florian Weimer wrote:
>>> * Adhemerval Zanella:
>>>
>>>> +      /* tmpbuf contains both the user and the __getpwnam_r working area.  */
>>>>        struct scratch_buffer tmpbuf;
>>>>        scratch_buffer_init (&tmpbuf);
>>>> +      if (!scratch_buffer_set_array_size (&tmpbuf, userlen + 1, 1))
>>>> +	return WRDE_NOSPACE;
>>>> +      char *user = tmpbuf.data;
>>>> +      memcpy (user, &words[1 + *offset], userlen);
>>>> +      user[userlen] = '\0';
>>>>  
>>>> +      struct passwd pwd, *tpwd;
>>>> +      int result;
>>>> +      while ((result = __getpwnam_r (user,
>>>> +				     &pwd,
>>>> +				     tmpbuf.data + userlen + 1,
>>>> +				     tmpbuf.length - userlen - 1,
>>>> +				     &tpwd)
>>>
>>> While this is technically correct, this looks like a bit of overkill.
>>> Maybe just use __strndup?  There is no reason to optimize this with an
>>> on-stack allocation.
>>
>> It keeps the same performance characteristic and is one less buffer to manage
>> (cleanup is done exclusive by scratch_buffer_free). 
> 
> The cost is that it turns a standard _r retry loop into a non-standard
> one.
> 

The extra cost is from scratch_buffer_grow_preserve, but since this should
be not the usual path I don't think this is a problem.  The wordexp
already uses a lot of dynamic allocation, I think we should try to avoid
one extra if possible.

> I don't have a strong opinion about this.  I hope to get rid of internal
> use of those _r functions eventually, at which point we can switch this
> to strndup.
> 
> Thanks,
> Florian
>