[PATCH v2] posix: Fix wordexp WRDE_APPEND to preserve state on non-NOSPACE errors (BZ 34090, CVE-2026-6368)

[Andreas Schwab]

On Jul 13 2026, Adhemerval Zanella wrote:

> @@ -2258,6 +2265,23 @@ wordexp (const char *words, wordexp_t *pwordexp, int flags)
>  	  pwordexp->we_offs = 0;
>  	}
>      }
> +  else if (pwordexp->we_wordv != NULL)
> +    {
> +      /* WRDE_APPEND with an existing word list: duplicate the array so that
> +	 realloc during parsing does not invalidate the caller's pointer.  The
> +	 strings themselves are shared.  */
> +      size_t num_p;
> +      char **dup;
> +      if (INT_ADD_WRAPV (pwordexp->we_offs, pwordexp->we_wordc, &num_p)
> +	  || INT_ADD_WRAPV (num_p, 1, &num_p))
> +	return WRDE_NOSPACE;

This can never happen, since it is exactly the size of the array to
duplicate.

-- 
Andreas Schwab, SUSE Labs, schwab@suse.de
GPG Key fingerprint = 0196 BAD8 1CE9 1970 F4BE  1748 E4D4 88E3 0EEA B9D7
"And now for something completely different."