[PATCH] posix: Fix wordexp WRDE_APPEND to preserve state on non-NOSPACE errors (BZ 34090, CVE-2026-6368)

[Adhemerval Zanella Netto]

On 01/07/26 10:18, Florian Weimer wrote:
> * Adhemerval Zanella:
> 
>> diff --git a/posix/tst-wordexp-append.c b/posix/tst-wordexp-append.c
>> new file mode 100644
>> index 0000000000..6253520c57
>> --- /dev/null
>> +++ b/posix/tst-wordexp-append.c
>> @@ -0,0 +1,307 @@
> 
>> +/* Attempt to force realloc to relocate the we_wordv buffer by placing an
>> +   allocation right after it.  Returns a pointer that must be freed after
>> +   the test.  */
>> +static void *
>> +place_blocker (void)
>> +{
>> +  void *p = xmalloc (0x1000);
>> +  /* Write to it so the compiler cannot optimize it away and the allocator
>> +     actually commits the pages.  */
>> +  memset (p, 0x41, 0x1000);
>> +  return p;
>> +}
> 
> Is it possible to replace this with an interposed realloc?  Wouldn't
> that result in a much more predictable test?

A interposed realloc would be better indeed to reproduce it, I use this to
follow the initial POC from the reporter. I will change to use it instead.

> 
> None of the tests check interaction with WRDE_DOOFFS.

Fair, I will add them as well.

> 
> The actual code changes look okay to me.
> 
> Thanks,
> Florian
>