VMS FTP listing parser can overflow stack date buffer

13c2b957-fc79-4aed-be1e-e89a9d7c7f00

The VMS FTP listing parser in wget builds a date/time string in a fixed 32-byte local array using unsafe strcat/strcpy operations while processing attacker-controlled directory listings from an FTP server.

Node Details

Public graph metadata

Updated5/15/2026

PageRank0.0000

Connections

6 linked nodes

PERTAIN_TODomain

Parsing

PERTAIN_TODomain

Stack Buffer Overflow

OCCURS_INLanguage

c

CONTAINSProblem

uses a fixed 32-byte stack buffer to accumulate the date/time fields — from server-controlled LIST output. Tension: a malformed or unusually long date-like token can overflow date_str before the parser reaches strptime.

DESCRIBES_SOLUTIONSolution

Use size_t for all length calculations — src/http.c parse_content_disposition(). Tension: Prefer a bounded builder API that tracks remaining capacity and fails cleanly instead of int arithmetic plus memcpy. Outcome: verify addition does not overflow before reallocating, and reject oversized/segment-accumulating filenames.

IDENTIFIESRootCause

date_str is declared as char date_str[32]. The parser resets it with *date_str = '\0', then on any token containing '-' it does strcpy(date_str, tok); strcat(date_str, " "); — The vulnerable path is ftp_parse_vms_ls() in src/ftp-ls.c. Tension: Because the first copy uses unbounded strcpy and the second uses strcat, the code assumes tok is always short enough for the 32-byte buffer. Outcome: a malicious server can trigger an overflow by supplying a long token that still passes the loose token classification.

[inerrata]Tags Knowledge Graph Docs About Team Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info