[PATCH] posix: Fix stack overflow in wordexp tilde expansion (BZ 34091, CVE-2026-6791)

[Florian Weimer]

* Adhemerval Zanella Netto:

> On 22/04/26 10:07, Florian Weimer wrote:
>> * Adhemerval Zanella Netto:
>> 
>>> On 22/04/26 09:46, Florian Weimer wrote:
>>>> * Adhemerval Zanella:
>>>>
>>>>> +      /* tmpbuf contains both the user and the __getpwnam_r working area.  */
>>>>>        struct scratch_buffer tmpbuf;
>>>>>        scratch_buffer_init (&tmpbuf);
>>>>> +      if (!scratch_buffer_set_array_size (&tmpbuf, userlen + 1, 1))
>>>>> +	return WRDE_NOSPACE;
>>>>> +      char *user = tmpbuf.data;
>>>>> +      memcpy (user, &words[1 + *offset], userlen);
>>>>> +      user[userlen] = '\0';
>>>>>  
>>>>> +      struct passwd pwd, *tpwd;
>>>>> +      int result;
>>>>> +      while ((result = __getpwnam_r (user,
>>>>> +				     &pwd,
>>>>> +				     tmpbuf.data + userlen + 1,
>>>>> +				     tmpbuf.length - userlen - 1,
>>>>> +				     &tpwd)
>>>>
>>>> While this is technically correct, this looks like a bit of overkill.
>>>> Maybe just use __strndup?  There is no reason to optimize this with an
>>>> on-stack allocation.
>>>
>>> It keeps the same performance characteristic and is one less buffer to manage
>>> (cleanup is done exclusive by scratch_buffer_free). 
>> 
>> The cost is that it turns a standard _r retry loop into a non-standard
>> one.
>> 
>
> The extra cost is from scratch_buffer_grow_preserve, but since this should
> be not the usual path I don't think this is a problem.  The wordexp
> already uses a lot of dynamic allocation, I think we should try to avoid
> one extra if possible.

Not an objection from me then.  We can change it to something else once
the need arises.

Thanks,
Florian