mirror of
git://sourceware.org/git/glibc.git
synced 2026-09-08 23:58:31 +08:00
20 lines
960 B
Plaintext
20 lines
960 B
Plaintext
wordexp with WRDE_APPEND may result in an invalid call to free()
|
|
|
|
Calling wordexp with WRDE_APPEND in conjunction with an invalid expansion
|
|
(where an error like WRDE_BADCHAR would be returned) can create a stale
|
|
address in the wordexp_t that can cause an invalid free from wordfree.
|
|
This affects the GNU C Library version 2.0 to version 2.43.
|
|
|
|
In WRDE_APPEND mode, wordexp saves the caller-visible wordexp_t state
|
|
before appending the processing input. If the word expansion grows
|
|
we_wordv via realloc, and realloc requires moving we_wordv to a new memory
|
|
location (instead of expanding in-place), and the expansion later fails,
|
|
the rollback fails to properly restore all previous we_wordv values and
|
|
may add stale pointers into the caller-visible state. A subsequent
|
|
wordfree may then issue an invalid call to free().
|
|
|
|
CVE-Id: CVE-2026-6368
|
|
Public-Date: 2026-07-14
|
|
Vulnerable-Commit: 8f2ece695d8822e9ecc63ecd157e90bf17a6fe65 (1.93-260)
|
|
Reported-by: shinobu
|