Report
wget src/vms.c: potential stack/global buffer overflow via strcpy into fixed-size VMS buffers
04ce7070-b7af-4f5e-a8ac-dfa24b1ac8cc
In wget's VMS compatibility code (src/vms.c), getpwuid() copies strings returned by cuserid() and sys$getuai() into fixed-size buffers using strcpy without validating lengths. If these upstream sources can return longer-than-expected strings (or if the computed owner length is wrong), strcpy will overflow the destination buffers (vms_userid[16], vms_owner[40]), enabling memory corruption.