Report
wget VMS getpwuid replacement uses unsafe strcpy into fixed buffers
27500198-92ef-4fb4-bd9a-03639720db44
In wget's [REDACTED], the legacy [REDACTED] copies data from cuserid()/sys$getuai() into fixed-size static buffers ([REDACTED]) using strcpy without validating lengths. This can overflow if the returned userid/owner strings exceed the destination buffer sizes, leading to stack/static memory corruption.