[{"id":3680603,"web_url":"http://patchwork.ozlabs.org/comment/3680603/","msgid":"","list_archive_url":null,"date":"2026-04-22T12:46:39","subject":"Re: [PATCH] posix: Fix stack overflow in wordexp tilde expansion\n (BZ 34091, CVE-2026-6791)","submitter":{"id":14312,"url":"http://patchwork.ozlabs.org/api/people/14312/","name":"Florian Weimer","email":"fweimer@redhat.com"},"content":"* Adhemerval Zanella:\n\n> + /* tmpbuf contains both the user and the __getpwnam_r working area. */\n> struct scratch_buffer tmpbuf;\n> scratch_buffer_init (&tmpbuf);\n> + if (!scratch_buffer_set_array_size (&tmpbuf, userlen + 1, 1))\n> +\treturn WRDE_NOSPACE;\n> + char *user = tmpbuf.data;\n> + memcpy (user, &words[1 + *offset], userlen);\n> + user[userlen] = '\\0';\n> \n> + struct passwd pwd, *tpwd;\n> + int result;\n> + while ((result = __getpwnam_r (user,\n> +\t\t\t\t &pwd,\n> +\t\t\t\t tmpbuf.data + userlen + 1,\n> +\t\t\t\t tmpbuf.length - userlen - 1,\n> +\t\t\t\t &tpwd)\n\nWhile this is technically correct, this looks like a bit of overkill.\nMaybe just use __strndup? There is no reason to optimize this with an\non-stack allocation.\n\nThanks,\nFlorian","headers":{"Return-Path":"","X-Original-To":["incoming@patchwork.ozlabs.org","libc-alpha@sourceware.org"],"Delivered-To":["patchwork-incoming@legolas.ozlabs.org","libc-alpha@sourceware.org"],"Authentication-Results":["legolas.ozlabs.org;\n\tdkim=pass (1024-bit key;\n unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256\n header.s=mimecast20190719 header.b=evCkMiHJ;\n\tdkim-atps=neutral","legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=sourceware.org\n (client-ip=2620:52:6:3111::32; helo=vm01.sourceware.org;\n envelope-from=libc-alpha-bounces~incoming=patchwork.ozlabs.org@sourceware.org;\n receiver=patchwork.ozlabs.org)","sourceware.org;\n\tdkim=pass (1024-bit key,\n unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256\n header.s=mimecast20190719 header.b=evCkMiHJ","sourceware.org; dmarc=pass (p=quarantine dis=none)\n header.from=redhat.com","sourceware.org; spf=pass smtp.mailfrom=redhat.com","server2.sourceware.org;\n arc=none smtp.remote-ip=170.10.133.124"],"Received":["from vm01.sourceware.org (vm01.sourceware.org\n [IPv6:2620:52:6:3111::32])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4g0zWj5l1nz1y2d\n\tfor ; Wed, 22 Apr 2026 22:47:13 +1000 (AEST)","from vm01.sourceware.org (localhost [127.0.0.1])\n\tby sourceware.org (Postfix) with ESMTP id BFDFC4B9DB55\n\tfor ; Wed, 22 Apr 2026 12:47:11 +0000 (GMT)","from us-smtp-delivery-124.mimecast.com\n (us-smtp-delivery-124.mimecast.com [170.10.133.124])\n by sourceware.org (Postfix) with ESMTP id 43C6B4BA23F4\n for ; Wed, 22 Apr 2026 12:46:49 +0000 (GMT)","from mx-prod-mc-01.mail-002.prod.us-west-2.aws.redhat.com\n (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by\n relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3,\n cipher=TLS_AES_256_GCM_SHA384) id us-mta-344-mvqtGX1mOzud_oYdYk2NBw-1; Wed,\n 22 Apr 2026 08:46:46 -0400","from mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com\n (mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.17])\n (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest\n SHA256)\n (No client certificate requested)\n by mx-prod-mc-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS\n id C0D4F195609E; Wed, 22 Apr 2026 12:46:45 +0000 (UTC)","from fweimer-oldenburg.csb.redhat.com (unknown [10.44.49.45])\n by mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with\n ESMTPS\n id 6722919560AB; Wed, 22 Apr 2026 12:46:42 +0000 (UTC)"],"DKIM-Filter":["OpenDKIM Filter v2.11.0 sourceware.org BFDFC4B9DB55","OpenDKIM Filter v2.11.0 sourceware.org 43C6B4BA23F4"],"DMARC-Filter":"OpenDMARC Filter v1.4.2 sourceware.org 43C6B4BA23F4","ARC-Filter":"OpenARC Filter v1.0.0 sourceware.org 43C6B4BA23F4","ARC-Seal":"i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1776862009; cv=none;\n b=sATiWhPOm8p7icnwwkckJu55G8heyTpxGF95EwqLMrsI+H456IjE9W6Qd5ldFlv8IoLkKWiPzYrnHk5JsN26m2O2hAPA9Bz17Pe3LP5WqIg4DCn163eJoXf18LpqAEt2jxrhqdEl7wAaBUu/NraLKQCdLWylFZR6kJo6zK7JrWQ=","ARC-Message-Signature":"i=1; a=rsa-sha256; d=sourceware.org; s=key;\n t=1776862009; c=relaxed/simple;\n bh=jE/k4D5+7ZnfeOMn/E6tJ6vHyLQcp3RKaDNGznrKnl0=;\n h=DKIM-Signature:From:To:Subject:Date:Message-ID:MIME-Version;\n b=MMKRC58hqyV7qxJflJUpyO6xvCGtL1/l6YqN7H2YJuw1RvVLh4xejEnp6D0M3ZuKZFGqHnU/YRSuS4y2cIMNIpVM0uLBpK7OvXxhVCirtSLGxpD0S0gEPs8BzSnqvJwmWUp8vqD7G/5hg4kTqzlP3e1U3/4fTf6PvWgYamJDy3Q=","ARC-Authentication-Results":"i=1; server2.sourceware.org","DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com;\n s=mimecast20190719; t=1776862008;\n h=from:from:reply-to:subject:subject:date:date:message-id:message-id:\n to:to:cc:cc:mime-version:mime-version:content-type:content-type:\n in-reply-to:in-reply-to:references:references;\n bh=kCPtLan194G9CouIKZvZCSseaxxjNeCPxfmY7OSimus=;\n b=evCkMiHJKjRxdwh8qsw7PUrzVtLwOYT2pO28/TFSMMly03qOg3yZ8ragEu705kRBUi8ZNi\n LLW9eGmXicqRD9lR8hnxyR+Ei5ii3EuH+u3b+ZPBs+X4HFlzjGXagxAZAz/U0eF/Tk+v9S\n /IsnbXRwleOAlWCgqOcsV6XPFMzkkE0=","X-MC-Unique":"mvqtGX1mOzud_oYdYk2NBw-1","X-Mimecast-MFC-AGG-ID":"mvqtGX1mOzud_oYdYk2NBw_1776862006","From":"Florian Weimer ","To":"Adhemerval Zanella ","Cc":"libc-alpha@sourceware.org, Siddhesh Poyarekar ,\n Carlos O'Donell ","Subject":"Re: [PATCH] posix: Fix stack overflow in wordexp tilde expansion\n (BZ 34091, CVE-2026-6791)","In-Reply-To":"<20260422123538.889818-1-adhemerval.zanella@linaro.org>\n (Adhemerval Zanella's message of \"Wed, 22 Apr 2026 09:35:30 -0300\")","References":"<20260422123538.889818-1-adhemerval.zanella@linaro.org>","Date":"Wed, 22 Apr 2026 14:46:39 +0200","Message-ID":"","User-Agent":"Gnus/5.13 (Gnus v5.13)","MIME-Version":"1.0","X-Scanned-By":"MIMEDefang 3.0 on 10.30.177.17","X-Mimecast-Spam-Score":"0","X-Mimecast-MFC-PROC-ID":"MV0R48dEopyxHTJzk-XMzbJi2q3Cd69ME6kOjaOfS4Q_1776862006","X-Mimecast-Originator":"redhat.com","Content-Type":"text/plain","X-BeenThere":"libc-alpha@sourceware.org","X-Mailman-Version":"2.1.30","Precedence":"list","List-Id":"Libc-alpha mailing list ","List-Unsubscribe":",\n ","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n ","Errors-To":"libc-alpha-bounces~incoming=patchwork.ozlabs.org@sourceware.org"}},{"id":3680613,"web_url":"http://patchwork.ozlabs.org/comment/3680613/","msgid":"<62c3a3bc-8833-4e76-b8d4-53eebe9b81db@linaro.org>","list_archive_url":null,"date":"2026-04-22T13:02:09","subject":"Re: [PATCH] posix: Fix stack overflow in wordexp tilde expansion (BZ\n 34091, CVE-2026-6791)","submitter":{"id":66065,"url":"http://patchwork.ozlabs.org/api/people/66065/","name":"Adhemerval Zanella Netto","email":"adhemerval.zanella@linaro.org"},"content":"On 22/04/26 09:46, Florian Weimer wrote:\n> * Adhemerval Zanella:\n> \n>> + /* tmpbuf contains both the user and the __getpwnam_r working area. */\n>> struct scratch_buffer tmpbuf;\n>> scratch_buffer_init (&tmpbuf);\n>> + if (!scratch_buffer_set_array_size (&tmpbuf, userlen + 1, 1))\n>> +\treturn WRDE_NOSPACE;\n>> + char *user = tmpbuf.data;\n>> + memcpy (user, &words[1 + *offset], userlen);\n>> + user[userlen] = '\\0';\n>> \n>> + struct passwd pwd, *tpwd;\n>> + int result;\n>> + while ((result = __getpwnam_r (user,\n>> +\t\t\t\t &pwd,\n>> +\t\t\t\t tmpbuf.data + userlen + 1,\n>> +\t\t\t\t tmpbuf.length - userlen - 1,\n>> +\t\t\t\t &tpwd)\n> \n> While this is technically correct, this looks like a bit of overkill.\n> Maybe just use __strndup? There is no reason to optimize this with an\n> on-stack allocation.\n\nIt keeps the same performance characteristic and is one less buffer to manage\n(cleanup is done exclusive by scratch_buffer_free).","headers":{"Return-Path":"","X-Original-To":["incoming@patchwork.ozlabs.org","libc-alpha@sourceware.org"],"Delivered-To":["patchwork-incoming@legolas.ozlabs.org","libc-alpha@sourceware.org"],"Authentication-Results":["legolas.ozlabs.org;\n\tdkim=pass (2048-bit key;\n unprotected) header.d=linaro.org header.i=@linaro.org header.a=rsa-sha256\n header.s=google header.b=D2u92OIq;\n\tdkim-atps=neutral","legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=sourceware.org\n (client-ip=38.145.34.32; helo=vm01.sourceware.org;\n envelope-from=libc-alpha-bounces~incoming=patchwork.ozlabs.org@sourceware.org;\n receiver=patchwork.ozlabs.org)","sourceware.org;\n\tdkim=pass (2048-bit key,\n unprotected) header.d=linaro.org header.i=@linaro.org header.a=rsa-sha256\n header.s=google header.b=D2u92OIq","sourceware.org;\n dmarc=pass (p=none dis=none) header.from=linaro.org","sourceware.org; spf=pass smtp.mailfrom=linaro.org","server2.sourceware.org;\n arc=none smtp.remote-ip=2607:f8b0:4864:20::1329"],"Received":["from vm01.sourceware.org (vm01.sourceware.org [38.145.34.32])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4g0zsg4QPcz1y2d\n\tfor ; Wed, 22 Apr 2026 23:02:47 +1000 (AEST)","from vm01.sourceware.org (localhost [127.0.0.1])\n\tby sourceware.org (Postfix) with ESMTP id 75DD44BBCDAC\n\tfor ; Wed, 22 Apr 2026 13:02:45 +0000 (GMT)","from mail-dy1-x1329.google.com (mail-dy1-x1329.google.com\n [IPv6:2607:f8b0:4864:20::1329])\n by sourceware.org (Postfix) with ESMTPS id 9BCA74BBCDCE\n for ; Wed, 22 Apr 2026 13:02:14 +0000 (GMT)","by mail-dy1-x1329.google.com with SMTP id\n 5a478bee46e88-2b4520f6b32so7067361eec.0\n for ; Wed, 22 Apr 2026 06:02:14 -0700 (PDT)","from ?IPV6:2804:1b3:a7c3:d5d0:bddf:fa51:e156:c28b?\n ([2804:1b3:a7c3:d5d0:bddf:fa51:e156:c28b])\n by smtp.gmail.com with ESMTPSA id\n 5a478bee46e88-2e539fa6134sm23770313eec.3.2026.04.22.06.02.10\n (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128);\n Wed, 22 Apr 2026 06:02:12 -0700 (PDT)"],"DKIM-Filter":["OpenDKIM Filter v2.11.0 sourceware.org 75DD44BBCDAC","OpenDKIM Filter v2.11.0 sourceware.org 9BCA74BBCDCE"],"DMARC-Filter":"OpenDMARC Filter v1.4.2 sourceware.org 9BCA74BBCDCE","ARC-Filter":"OpenARC Filter v1.0.0 sourceware.org 9BCA74BBCDCE","ARC-Seal":"i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1776862934; cv=none;\n b=J1Q3q4dmtidZYtZfUZ/OfQWdvyvp9oEhHdIXTCro7WEkEEx4faDOvBUcE92nn5LWgoWwAeVrbv7N9y8G/TSL7taquqXGpm8RF/UYtdGAFkWkdYvsffCKT7RV5f+I30pruWe1LZ1i6qDS2wnC7R1Qah4TU6Jt8F762/dkDSWUIwU=","ARC-Message-Signature":"i=1; a=rsa-sha256; d=sourceware.org; s=key;\n t=1776862934; c=relaxed/simple;\n bh=2ZiQ+Rh4uS0LuUT3G848+cwnS06RkE9sG4KVsY2b06I=;\n h=DKIM-Signature:Message-ID:Date:MIME-Version:Subject:To:From;\n b=p1xUDjhyLYWXASYb4d5nvH38+c4vcZ77WZrRaBz892ka+CrMy+Q6oxU/ZmjjDDLqZNrMXvfxtuhjToLnENr5T3g2fctXtCp1ziOkxotKMzk955kNraqhO84tV0XXzYYCFoaK3WmxPEIc60FZfKV8Vyl+ugzoEvhaENuBR/eBHRQ=","ARC-Authentication-Results":"i=1; server2.sourceware.org","DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=linaro.org; s=google; t=1776862934; x=1777467734; darn=sourceware.org;\n h=content-transfer-encoding:in-reply-to:organization:from\n :content-language:references:cc:to:subject:user-agent:mime-version\n :date:message-id:from:to:cc:subject:date:message-id:reply-to;\n bh=+/rGOc8+g1SUsKmP7srWem/OCAD1UOYjTsSgzccw1rg=;\n b=D2u92OIq4uCs2+I2ZnL2tFLOxMTsWs3O/3G+RzmogkDk9Qio7q/Sc7xagarYmcWTmC\n ixMdfJ+pyXYXa+sdU2NV/2NiUco3kFpYzjomwLz7SBSHzTJiMKG0khLHCmjIpXYPk0Ql\n nxPEOG68oGMy1gdIWUvPjd8c9cpnUpUJNSCDL+JtqE6Aj5g085N6D+kL6+nT8NhUGXdd\n 7K9YNgzemGT0eiYK0Kqrx8sfAcxD1qliLmZQlUbJXy9g7PgElqN4MWJVoxSo2jgH9Bgf\n ATU4UphhlAwUgofPBWYF1FXoxXTG2ev7cJE+KuePVkM3Pou28hAxy957NXy6LTPvjelA\n mvdg==","X-Google-DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=1e100.net; s=20251104; t=1776862934; x=1777467734;\n h=content-transfer-encoding:in-reply-to:organization:from\n :content-language:references:cc:to:subject:user-agent:mime-version\n :date:message-id:x-gm-gg:x-gm-message-state:from:to:cc:subject:date\n :message-id:reply-to;\n bh=+/rGOc8+g1SUsKmP7srWem/OCAD1UOYjTsSgzccw1rg=;\n b=ieYaXK68sX3d//AkJaIzjBh4S5m/VBSc3h0FKN8YjCoOhNpYCS24DQ0xvG0zaAX6zJ\n 38OdruzGCfDtXpBLHLo5REROmDYEq/BXUBICrPfiVC3yhqsALO79+6Ow7UfNcFaEGwJr\n ha5Gzl0g8Le44qk6slslJNMAmPxbrJHDvy/I1OsUg8CLGbJhYMT1VQPSazVCKUfQEeAU\n 20cKDgLHxeXlA+J2ofQOn00FdwJOmxTSMBbmi5zjI6a+D6h9tF7xTrqFjP5lP39cG5i/\n PyTDGvuiyI/ozPk8A5Ofvf3/AlgjGxrahWEvW3LWCF3u0x409QsN3AEik1NlQaIkcZXs\n aAUA==","X-Gm-Message-State":"AOJu0YxqFCVxtLPK3mo4BdVHcFHilIoJXltIxmkyxf3MHqZaR+/oYGHe\n 9+j+kSem0Ciz0kLI+6lzR44X6GTqDEkeYKZn+nXGSoj/MxB549E7ToL9jP0c2WsW/TE=","X-Gm-Gg":"AeBDievyEvfuC/HuB0BUrPQ8bBK2CoZc78IxSOV/kydFuHkhzp2YmzBiirGQeZ9OJsu\n w9q55m69bGar+HS4vAby3vLhHQX+gMjwlgzxuDfhnDMEQQzFgesfAkiybBohBWkjY2H6IUin7xT\n AKzwuZc+BjqhgYp+8vUgMqM+k+9AtkShfbc/rMpw68IqViJ+mKiH+CQt58HSqbs9Rtkwma0LEfQ\n ocbS2GNLkhRwyGdGW40Yr1mhM28ZDj+8wXpwg9DH0j708Ehy8oI2LvgtttVVlScAeFGBuzSXKEx\n rWU2BVHqeQWm5eAwB2bzlyIgqJ66cz/wzAzuAN4mM2ij9X5elSuNosDo/WN9Hb7GcARIfP9IUgp\n QQ70hSLtrrG5d8PVuBPvLPrZVwzy6co70L8Gd7p+T8I7GyOXB2uM353ahXou4XOv5h/ey5AamYP\n Q2Yt4BkAB8fXgwPchCCNJuPtVugS4q39i4UHmJi/5h9ptLw0vsUjPwJSjzj/A6iFPJi1UpnL6NX\n SHpXUXUB8JRxwC3Xest+csdZdQQNXXYBnfVCbfV18e0","X-Received":"by 2002:a05:7300:238d:b0:2c9:ee15:a0f1 with SMTP id\n 5a478bee46e88-2e4792151ddmr13002850eec.27.1776862932907;\n Wed, 22 Apr 2026 06:02:12 -0700 (PDT)","Message-ID":"<62c3a3bc-8833-4e76-b8d4-53eebe9b81db@linaro.org>","Date":"Wed, 22 Apr 2026 10:02:09 -0300","MIME-Version":"1.0","User-Agent":"Mozilla Thunderbird","Subject":"Re: [PATCH] posix: Fix stack overflow in wordexp tilde expansion (BZ\n 34091, CVE-2026-6791)","To":"Florian Weimer ","Cc":"libc-alpha@sourceware.org, Siddhesh Poyarekar ,\n Carlos O'Donell ","References":"<20260422123538.889818-1-adhemerval.zanella@linaro.org>\n ","Content-Language":"en-US","From":"Adhemerval Zanella Netto ","Organization":"Linaro","In-Reply-To":"","Content-Type":"text/plain; charset=UTF-8","Content-Transfer-Encoding":"7bit","X-BeenThere":"libc-alpha@sourceware.org","X-Mailman-Version":"2.1.30","Precedence":"list","List-Id":"Libc-alpha mailing list ","List-Unsubscribe":",\n ","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n ","Errors-To":"libc-alpha-bounces~incoming=patchwork.ozlabs.org@sourceware.org"}},{"id":3680617,"web_url":"http://patchwork.ozlabs.org/comment/3680617/","msgid":"","list_archive_url":null,"date":"2026-04-22T13:07:12","subject":"Re: [PATCH] posix: Fix stack overflow in wordexp tilde expansion\n (BZ 34091, CVE-2026-6791)","submitter":{"id":14312,"url":"http://patchwork.ozlabs.org/api/people/14312/","name":"Florian Weimer","email":"fweimer@redhat.com"},"content":"* Adhemerval Zanella Netto:\n\n> On 22/04/26 09:46, Florian Weimer wrote:\n>> * Adhemerval Zanella:\n>> \n>>> + /* tmpbuf contains both the user and the __getpwnam_r working area. */\n>>> struct scratch_buffer tmpbuf;\n>>> scratch_buffer_init (&tmpbuf);\n>>> + if (!scratch_buffer_set_array_size (&tmpbuf, userlen + 1, 1))\n>>> +\treturn WRDE_NOSPACE;\n>>> + char *user = tmpbuf.data;\n>>> + memcpy (user, &words[1 + *offset], userlen);\n>>> + user[userlen] = '\\0';\n>>> \n>>> + struct passwd pwd, *tpwd;\n>>> + int result;\n>>> + while ((result = __getpwnam_r (user,\n>>> +\t\t\t\t &pwd,\n>>> +\t\t\t\t tmpbuf.data + userlen + 1,\n>>> +\t\t\t\t tmpbuf.length - userlen - 1,\n>>> +\t\t\t\t &tpwd)\n>> \n>> While this is technically correct, this looks like a bit of overkill.\n>> Maybe just use __strndup? There is no reason to optimize this with an\n>> on-stack allocation.\n>\n> It keeps the same performance characteristic and is one less buffer to manage\n> (cleanup is done exclusive by scratch_buffer_free). \n\nThe cost is that it turns a standard _r retry loop into a non-standard\none.\n\nI don't have a strong opinion about this. I hope to get rid of internal\nuse of those _r functions eventually, at which point we can switch this\nto strndup.\n\nThanks,\nFlorian","headers":{"Return-Path":"","X-Original-To":["incoming@patchwork.ozlabs.org","libc-alpha@sourceware.org"],"Delivered-To":["patchwork-incoming@legolas.ozlabs.org","libc-alpha@sourceware.org"],"Authentication-Results":["legolas.ozlabs.org;\n\tdkim=pass (1024-bit key;\n unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256\n header.s=mimecast20190719 header.b=Pab2vKGJ;\n\tdkim-atps=neutral","legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=sourceware.org\n (client-ip=2620:52:6:3111::32; helo=vm01.sourceware.org;\n envelope-from=libc-alpha-bounces~incoming=patchwork.ozlabs.org@sourceware.org;\n receiver=patchwork.ozlabs.org)","sourceware.org;\n\tdkim=pass (1024-bit key,\n unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256\n header.s=mimecast20190719 header.b=Pab2vKGJ","sourceware.org; dmarc=pass (p=quarantine dis=none)\n header.from=redhat.com","sourceware.org; spf=pass smtp.mailfrom=redhat.com","server2.sourceware.org;\n arc=none smtp.remote-ip=170.10.129.124"],"Received":["from vm01.sourceware.org (vm01.sourceware.org\n [IPv6:2620:52:6:3111::32])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4g0zzx3YvTz1yD5\n\tfor ; Wed, 22 Apr 2026 23:08:13 +1000 (AEST)","from vm01.sourceware.org (localhost [127.0.0.1])\n\tby sourceware.org (Postfix) with ESMTP id 706A94BBCDE9\n\tfor ; Wed, 22 Apr 2026 13:08:11 +0000 (GMT)","from us-smtp-delivery-124.mimecast.com\n (us-smtp-delivery-124.mimecast.com [170.10.129.124])\n by sourceware.org (Postfix) with ESMTP id F19824BBCDFF\n for ; Wed, 22 Apr 2026 13:07:28 +0000 (GMT)","from mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com\n (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by\n relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3,\n cipher=TLS_AES_256_GCM_SHA384) id us-mta-355-adpu0GDlPrGp2PHG0RFW8w-1; Wed,\n 22 Apr 2026 09:07:25 -0400","from mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com\n (mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.12])\n (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest\n SHA256)\n (No client certificate requested)\n by mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS\n id 55E941800473; Wed, 22 Apr 2026 13:07:22 +0000 (UTC)","from fweimer-oldenburg.csb.redhat.com (unknown [10.44.49.45])\n by mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with\n ESMTPS\n id CCA5E19560AB; Wed, 22 Apr 2026 13:07:20 +0000 (UTC)"],"DKIM-Filter":["OpenDKIM Filter v2.11.0 sourceware.org 706A94BBCDE9","OpenDKIM Filter v2.11.0 sourceware.org F19824BBCDFF"],"DMARC-Filter":"OpenDMARC Filter v1.4.2 sourceware.org F19824BBCDFF","ARC-Filter":"OpenARC Filter v1.0.0 sourceware.org F19824BBCDFF","ARC-Seal":"i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1776863249; cv=none;\n b=U4Mx5CsQ1wQpT1Y/WV9q6i1b/pl8RQuKw2onobRCaNn9ut8sPaFrmAyevb2Oj0FeXq4EMy0k040ApzFKeIMWCeB5CASDcywWFzNFL8uNLudaQ8GR5UP1fiOGtYOHxFP1CYzvyUmSWGuiXqe7tmt5bT1/o+KIC5fF4GgbiJWob+Y=","ARC-Message-Signature":"i=1; a=rsa-sha256; d=sourceware.org; s=key;\n t=1776863249; c=relaxed/simple;\n bh=yDyheyu6TC1oVyiVxcvIfNeBLspVo+P5/krzcSgJ0Dc=;\n h=DKIM-Signature:From:To:Subject:Date:Message-ID:MIME-Version;\n b=suB7bQgJfels+wkybThCvFKQgJTQoLjggld6EUFdfexAbKTZPQz4p3JyklUh4xJXJVJYzRR+zmoF8IHqAxF2dLDtDC5aQaho1Xc2btvyMv9tM+2EcGDx9xNDPBh5tmA/MReskVclysVRW9//4iV9RkGlsKvPYwK87dKVx3NbLaI=","ARC-Authentication-Results":"i=1; server2.sourceware.org","DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com;\n s=mimecast20190719; t=1776863248;\n h=from:from:reply-to:subject:subject:date:date:message-id:message-id:\n to:to:cc:cc:mime-version:mime-version:content-type:content-type:\n in-reply-to:in-reply-to:references:references;\n bh=Pm7XfRHMvlM+B3ADWSezKez5IYi96F4WCBU40Y2oXvY=;\n b=Pab2vKGJ6bCYaTBhwrJZhjnAJQ/OnIdN9s4jSowifLx6koassjATEBDOp56o00L2mNK83X\n 0lBm0WZ+/ZpUlxlJnoNmGm5qVsTOZ7BGg9JpdmcDBd2EuPAWKREq6LciPkMc0PiPK2WRmw\n kXgKBV/qrhWhc0pIsxfTxkZ2aJDvHqA=","X-MC-Unique":"adpu0GDlPrGp2PHG0RFW8w-1","X-Mimecast-MFC-AGG-ID":"adpu0GDlPrGp2PHG0RFW8w_1776863242","From":"Florian Weimer ","To":"Adhemerval Zanella Netto ","Cc":"libc-alpha@sourceware.org, Siddhesh Poyarekar ,\n Carlos O'Donell ","Subject":"Re: [PATCH] posix: Fix stack overflow in wordexp tilde expansion\n (BZ 34091, CVE-2026-6791)","In-Reply-To":"<62c3a3bc-8833-4e76-b8d4-53eebe9b81db@linaro.org> (Adhemerval\n Zanella Netto's message of \"Wed, 22 Apr 2026 10:02:09 -0300\")","References":"<20260422123538.889818-1-adhemerval.zanella@linaro.org>\n \n <62c3a3bc-8833-4e76-b8d4-53eebe9b81db@linaro.org>","Date":"Wed, 22 Apr 2026 15:07:12 +0200","Message-ID":"","User-Agent":"Gnus/5.13 (Gnus v5.13)","MIME-Version":"1.0","X-Scanned-By":"MIMEDefang 3.0 on 10.30.177.12","X-Mimecast-Spam-Score":"0","X-Mimecast-MFC-PROC-ID":"qnuLb8H7_I1urdm245RGbFz9zKvUqF2JrmbsQlC9m4Y_1776863242","X-Mimecast-Originator":"redhat.com","Content-Type":"text/plain","X-BeenThere":"libc-alpha@sourceware.org","X-Mailman-Version":"2.1.30","Precedence":"list","List-Id":"Libc-alpha mailing list ","List-Unsubscribe":",\n ","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n ","Errors-To":"libc-alpha-bounces~incoming=patchwork.ozlabs.org@sourceware.org"}},{"id":3680620,"web_url":"http://patchwork.ozlabs.org/comment/3680620/","msgid":"<1ed4ccbc-d1c0-40b3-a500-54f9068ca9cc@linaro.org>","list_archive_url":null,"date":"2026-04-22T13:10:25","subject":"Re: [PATCH] posix: Fix stack overflow in wordexp tilde expansion (BZ\n 34091, CVE-2026-6791)","submitter":{"id":66065,"url":"http://patchwork.ozlabs.org/api/people/66065/","name":"Adhemerval Zanella Netto","email":"adhemerval.zanella@linaro.org"},"content":"On 22/04/26 10:07, Florian Weimer wrote:\n> * Adhemerval Zanella Netto:\n> \n>> On 22/04/26 09:46, Florian Weimer wrote:\n>>> * Adhemerval Zanella:\n>>>\n>>>> + /* tmpbuf contains both the user and the __getpwnam_r working area. */\n>>>> struct scratch_buffer tmpbuf;\n>>>> scratch_buffer_init (&tmpbuf);\n>>>> + if (!scratch_buffer_set_array_size (&tmpbuf, userlen + 1, 1))\n>>>> +\treturn WRDE_NOSPACE;\n>>>> + char *user = tmpbuf.data;\n>>>> + memcpy (user, &words[1 + *offset], userlen);\n>>>> + user[userlen] = '\\0';\n>>>> \n>>>> + struct passwd pwd, *tpwd;\n>>>> + int result;\n>>>> + while ((result = __getpwnam_r (user,\n>>>> +\t\t\t\t &pwd,\n>>>> +\t\t\t\t tmpbuf.data + userlen + 1,\n>>>> +\t\t\t\t tmpbuf.length - userlen - 1,\n>>>> +\t\t\t\t &tpwd)\n>>>\n>>> While this is technically correct, this looks like a bit of overkill.\n>>> Maybe just use __strndup? There is no reason to optimize this with an\n>>> on-stack allocation.\n>>\n>> It keeps the same performance characteristic and is one less buffer to manage\n>> (cleanup is done exclusive by scratch_buffer_free). \n> \n> The cost is that it turns a standard _r retry loop into a non-standard\n> one.\n> \n\nThe extra cost is from scratch_buffer_grow_preserve, but since this should\nbe not the usual path I don't think this is a problem. The wordexp\nalready uses a lot of dynamic allocation, I think we should try to avoid\none extra if possible.\n\n> I don't have a strong opinion about this. I hope to get rid of internal\n> use of those _r functions eventually, at which point we can switch this\n> to strndup.\n> \n> Thanks,\n> Florian\n>","headers":{"Return-Path":"","X-Original-To":["incoming@patchwork.ozlabs.org","libc-alpha@sourceware.org"],"Delivered-To":["patchwork-incoming@legolas.ozlabs.org","libc-alpha@sourceware.org"],"Authentication-Results":["legolas.ozlabs.org;\n\tdkim=pass (2048-bit key;\n unprotected) header.d=linaro.org header.i=@linaro.org header.a=rsa-sha256\n header.s=google header.b=DMCcktHU;\n\tdkim-atps=neutral","legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=sourceware.org\n (client-ip=38.145.34.32; helo=vm01.sourceware.org;\n envelope-from=libc-alpha-bounces~incoming=patchwork.ozlabs.org@sourceware.org;\n receiver=patchwork.ozlabs.org)","sourceware.org;\n\tdkim=pass (2048-bit key,\n unprotected) header.d=linaro.org header.i=@linaro.org header.a=rsa-sha256\n header.s=google header.b=DMCcktHU","sourceware.org;\n dmarc=pass (p=none dis=none) header.from=linaro.org","sourceware.org; spf=pass smtp.mailfrom=linaro.org","server2.sourceware.org;\n arc=none smtp.remote-ip=2607:f8b0:4864:20::122c"],"Received":["from vm01.sourceware.org (vm01.sourceware.org [38.145.34.32])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4g103910lzz1yCv\n\tfor ; Wed, 22 Apr 2026 23:11:01 +1000 (AEST)","from vm01.sourceware.org (localhost [127.0.0.1])\n\tby sourceware.org (Postfix) with ESMTP id 2102D4BBCDE5\n\tfor ; Wed, 22 Apr 2026 13:10:59 +0000 (GMT)","from mail-dl1-x122c.google.com (mail-dl1-x122c.google.com\n [IPv6:2607:f8b0:4864:20::122c])\n by sourceware.org (Postfix) with ESMTPS id 5625D4BBCDC3\n for ; Wed, 22 Apr 2026 13:10:31 +0000 (GMT)","by mail-dl1-x122c.google.com with SMTP id\n a92af1059eb24-12c19d23b19so6918995c88.0\n for ; Wed, 22 Apr 2026 06:10:31 -0700 (PDT)","from ?IPV6:2804:1b3:a7c3:d5d0:bddf:fa51:e156:c28b?\n ([2804:1b3:a7c3:d5d0:bddf:fa51:e156:c28b])\n by smtp.gmail.com with ESMTPSA id\n a92af1059eb24-12da8b8fbc4sm13622969c88.4.2026.04.22.06.10.26\n (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128);\n Wed, 22 Apr 2026 06:10:27 -0700 (PDT)"],"DKIM-Filter":["OpenDKIM Filter v2.11.0 sourceware.org 2102D4BBCDE5","OpenDKIM Filter v2.11.0 sourceware.org 5625D4BBCDC3"],"DMARC-Filter":"OpenDMARC Filter v1.4.2 sourceware.org 5625D4BBCDC3","ARC-Filter":"OpenARC Filter v1.0.0 sourceware.org 5625D4BBCDC3","ARC-Seal":"i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1776863431; cv=none;\n b=MkBALRPf3quL/yyIGCOpIaF1yvXXZ9PXR/rqqLFvblyijftPKnv3CNOiT99ySjoBlpttIWhB2xQH4l2s+xCKnerUmCKhjS3TgoB9HreQgmsUA8XtPHIOuguYbTc/QGRuGrfaNjb9KcRjlHAkW08K/fakQ4ukNOKFW9uLn/5R2+k=","ARC-Message-Signature":"i=1; a=rsa-sha256; d=sourceware.org; s=key;\n t=1776863431; c=relaxed/simple;\n bh=cwXTbU6JQY5oIt2G/u0JLhmfY0kPr+L/tt9syL8lOM0=;\n h=DKIM-Signature:Message-ID:Date:MIME-Version:Subject:To:From;\n b=ZoAyR8AQtL+0RwI/BZOrZu03Rz4Qb4461Vq2vOqOVCZShQisrkojko7uvepcIa8ZXbmHnYzSSWMutgazwqg8HwBETsse3IOU4ZflatRLcxOozhvEGk0nN0fz62lc9v3nRPiD9bZDfYTofx35umATgNdurbWLnuslwoYzzeU680s=","ARC-Authentication-Results":"i=1; server2.sourceware.org","DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=linaro.org; s=google; t=1776863430; x=1777468230; darn=sourceware.org;\n h=content-transfer-encoding:in-reply-to:organization:from\n :content-language:references:cc:to:subject:user-agent:mime-version\n :date:message-id:from:to:cc:subject:date:message-id:reply-to;\n bh=r6z0BizKluITHbEv0U6weIitDoQrWHmGeSrGZtxj930=;\n b=DMCcktHUNxrtduc9jkBhUj0YGDLItQwPjKTxgHxl2UcFv4wFsXKHGoQzlsSCp58OlX\n HPPzHYpA9JNlFPF9khq/ymGyF9Sw9VLrU7zJYJnWNW/U29r/VdgrxchIuhvWYA2I/d4P\n YUYKFSA7mP78jhX3NgQ/NEb9u0+fGH0a3hzZkMzlOiGeSwel3YK5SpppFgl3IP/UY6oP\n Y8HkAvmXe/ZXjgb4jsj8AAdskEF+198EJ8nYL4vaM2to3iZTTvyanFedIPbXAIb4an9F\n NRUQNwbn95+1YL23xMQffUH6lsHidokqbn6puLtprBFIhVgygSM/QuGkCL1jiddoBPy5\n NjBA==","X-Google-DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=1e100.net; s=20251104; t=1776863430; x=1777468230;\n h=content-transfer-encoding:in-reply-to:organization:from\n :content-language:references:cc:to:subject:user-agent:mime-version\n :date:message-id:x-gm-gg:x-gm-message-state:from:to:cc:subject:date\n :message-id:reply-to;\n bh=r6z0BizKluITHbEv0U6weIitDoQrWHmGeSrGZtxj930=;\n b=NP46y2cKdrG47SeBS3X4EzgCIBlMJgnOpzNeOlERqOPQuO5tAGRT/YZLw108F/Ogc9\n tWgIH2iiN/120zWcUJgSev9r86ci+v7xoUMf5DD1CN20mg/9xE6VLge4q26Myy7Yi05S\n sOCtjLo0FFY6t92DllG2vDVvOOirwFVSgHLWoyDWVWp5i4vZ2WzpLb3UV/BLz1DVDaDC\n cXsQsq2Q9HtDthO0mr8W8OVCAfvc0hwXuWhC2i4u2dhfXinQknDqu4YLvchYgI0pGXNe\n xRhXPl8dUR8BH3CdiACr9f2jD7lTCe5y0HUsu6iSR72NKbCg6nXuo48raOiByonr7OeW\n cv8g==","X-Gm-Message-State":"AOJu0YwFRnyQj1hr4FhF7uQR+XJM0SmCMgOKm0NLgh7B55fleZNi0dlu\n a4FWXe7w6SetDypa3bCjJW8NGGyhwaZksgWHzDSegL0IJo2UWpssnEoV4IjV5L3NIOU=","X-Gm-Gg":"AeBDievFN2W/1iCq8tMjirQWNHS1dudKCSXJi4lJodzGULdK3wIe1zLigW0Lh5WTswo\n DHWtfc+eLsCw3OaaWcnyMX75F2X0Iwbkl7VZG/V0F8V7AqGetdOydDoL38sNEQ7l1MNVec3WtkY\n DNt1wb2Bck3qUsDKTkx358L1IgA7lLf31l0RxQl7+PiV/M0qixUiFW9cCXoKbrmSVD90D9542cE\n z5q1T1Dm/JQA7nCnJeybayZnv3+OaAM4fhwFP2UNpvfzcnZkOQc/tblV4nBJfZ/jLCS6jNVQ0yv\n vPw9HWu3sa2kN7kTOx+brgFRyjjEkVx/WAXur6wHFjkEUCIPs6KYngBjQ98XatPhbsuiWG3LblM\n mcfxP1mpYwUUFwbKXw+JOzNy0+su2CU6EWNm8VZZBpIIFCwXddgKq0XXNG69qbvFBXs34Tyn/1u\n kBQDfkn41td/6qEooMHrXTsZdiQ1nrgedWWe6OYo2QdJmZneSz0ePgDZtsXvTYfcG0BZxY0ZkUf\n GjiGpXw0L17wN1gEzYd60k1ECZldmF4re4BgDYOfL+2","X-Received":"by 2002:a05:7022:50d:b0:12a:747e:5b5c with SMTP id\n a92af1059eb24-12c73fa3af3mr12025975c88.24.1776863428592;\n Wed, 22 Apr 2026 06:10:28 -0700 (PDT)","Message-ID":"<1ed4ccbc-d1c0-40b3-a500-54f9068ca9cc@linaro.org>","Date":"Wed, 22 Apr 2026 10:10:25 -0300","MIME-Version":"1.0","User-Agent":"Mozilla Thunderbird","Subject":"Re: [PATCH] posix: Fix stack overflow in wordexp tilde expansion (BZ\n 34091, CVE-2026-6791)","To":"Florian Weimer ","Cc":"libc-alpha@sourceware.org, Siddhesh Poyarekar ,\n Carlos O'Donell ","References":"<20260422123538.889818-1-adhemerval.zanella@linaro.org>\n \n <62c3a3bc-8833-4e76-b8d4-53eebe9b81db@linaro.org>\n ","Content-Language":"en-US","From":"Adhemerval Zanella Netto ","Organization":"Linaro","In-Reply-To":"","Content-Type":"text/plain; charset=UTF-8","Content-Transfer-Encoding":"7bit","X-BeenThere":"libc-alpha@sourceware.org","X-Mailman-Version":"2.1.30","Precedence":"list","List-Id":"Libc-alpha mailing list ","List-Unsubscribe":",\n ","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n ","Errors-To":"libc-alpha-bounces~incoming=patchwork.ozlabs.org@sourceware.org"}}]