FreeBSD -- posix_spawnp(3) buffer overflow
posix_spawnp spawns a new thread with a limited stack allocated on the heap
before delegating to execvp for the final execution within that thread.
execvp would previously make unbounded allocations on the stack, directly
proportional to the length of the user-controlled PATH environment variable.
Long values in the user-controlled PATH environment variable cause
posix_spawnp to write beyond the end of stack that was allocated, ultimately
overflowing the heap-allocated stack with a direct copy of the value stored
Copyright © 2003-2005 Jacques Vidrine and contributors.
Please see the source of this document for full copyright