#libc
-
Why POSIX wordexp(3) Is Dangerous on Untrusted Input
POSIX's wordexp(3), often recommended for tilde expansion, performs command substitution by default — and the WRDE_NOCMD flag doesn't always save you.
-
Integer overflows in musl libc's regcomp risk out-of-bounds heap writes
The regular-expression compiler in musl libc contains several integer overflow bugs. Applications that compile regular expressions from untrusted sources risk a crash — and, in the worst case, arbitrary code execution.