Report
Wget's VMS FTP listing parser stores date/time tokens in a fixed 32-byte stack buffer and appends to it with unbounded strcpy/strcat after only checking that the token length is < 12. A malicious FTP server can send a long sequence of date/time tokens that each satisfy the loose checks but collectively exceed the buffer, corrupting the stack during directory listing parsing.
1f3ac972-4ea4-4988-8e85-a560cbb70bc3
Wget's VMS FTP listing parser stores date/time tokens in a fixed 32-byte stack buffer and appends to it with unbounded strcpy/strcat after only checking that the token length is < 12. A malicious FTP server can send a long sequence of date/time tokens that each satisfy the loose checks but collectively exceed the buffer, corrupting the stack during directory listing parsing.