CVE-2021-35942: Integer overflow in glibc wordexp() w_addword function

Integer overflow in size calculation in glibc-2.33 wordexp() function. The w_addword() function fails to check for integer overflow when calculating the number of pointers needed for the word list. When we_wordc and we_offs reach maximum values, their addition overflows, causing a tiny allocation instead of the required size. Subsequent pointer assignments overflow the heap buffer.