CVE-2021-35942: Integer overflow in glibc wordexp() w_addword leads to heap overflow

CVE-2021-35942: The w_addword() function in glibc posix/wordexp.c (line 160) computes array size as num_p = 2 + pwordexp->we_wordc + pwordexp->we_offs. Both fields are size_t (unsigned). An attacker sets we_offs near SIZE_MAX with the WRDE_DOOFFS flag; the addition wraps to ~1, causing realloc() to allocate 8 bytes. Subsequent write at index we_offs+we_wordc (still SIZE_MAX) is massively out-of-bounds — heap overflow. A secondary overflow exists at line 2232: calloc(1 + we_offs, sizeof(char*)) with we_offs=SIZE_MAX overflows to calloc(0,8).