entr EUVD-2026-55623

entr is an open-source, BSD-licensed file-watching utility that executes user-specified shell commands whenever monitored files change, commonly used in developer build loops and CI pipelines. The vulnerable function run_utility() allocates a fixed-size heap buffer of ARG_MAX bytes via malloc() and iterates over command-line arguments to clone them into this buffer on each invocation. The root cause is CWE-122 (Heap-based Buffer Overflow) arising from misuse of strlcpy(): the POSIX strlcpy() function returns the total length of the source string - not the number of bytes actually copied, which is capped by the size parameter. The original code used this uncapped return value to advance the destination pointer p, so when a string exactly fills remaining buffer space, the expression ARG_MAX - (p - arg_buf) wraps around to a very large unsigned value on the next iteration, and the subsequent copy writes arbitrarily far beyond the heap allocation. The slash-underscore substitution feature exacerbates this by replacing a short literal token with a full filesystem pathname at runtime, making the overflow triggerable without obviously long argument strings. The fix in commit 2467fe0 replaces strlcpy with an explicit strlen-based bounds check followed by memcpy, tracks remaining capacity in a dedicated rem variable decremented after each copy, and adds a null-pointer guard on the malloc return.