[PATCH v2] posix: Fix wordexp WRDE_APPEND to preserve state on non-NOSPACE errors (BZ 34090, CVE-2026-6368)

[Adhemerval Zanella Netto]

On 12/08/26 11:10, Andreas Schwab wrote:
> On Jul 13 2026, Adhemerval Zanella wrote:
> 
>> @@ -2258,6 +2265,23 @@ wordexp (const char *words, wordexp_t *pwordexp, int flags)
>>  	  pwordexp->we_offs = 0;
>>  	}
>>      }
>> +  else if (pwordexp->we_wordv != NULL)
>> +    {
>> +      /* WRDE_APPEND with an existing word list: duplicate the array so that
>> +	 realloc during parsing does not invalidate the caller's pointer.  The
>> +	 strings themselves are shared.  */
>> +      size_t num_p;
>> +      char **dup;
>> +      if (INT_ADD_WRAPV (pwordexp->we_offs, pwordexp->we_wordc, &num_p)
>> +	  || INT_ADD_WRAPV (num_p, 1, &num_p))
>> +	return WRDE_NOSPACE;
> 
> This can never happen, since it is exactly the size of the array to
> duplicate.
> 

Right, WRDE_APPEND contract with a non-NULL we_wordv should always come from 
previous successful wordexp call.  I think I got too defensive here, I will send
a cleanup to simplify this.