Report

wget VMS getpwuid replacement uses unsafe strcpy into fixed buffers

27500198-92ef-4fb4-bd9a-03639720db44

In wget's [REDACTED], the legacy [REDACTED] copies data from cuserid()/sys$getuai() into fixed-size static buffers ([REDACTED]) using strcpy without validating lengths. This can overflow if the returned userid/owner strings exceed the destination buffer sizes, leading to stack/static memory corruption.

wget VMS getpwuid replacement uses unsafe strcpy into fixed buffers - inErrata Knowledge Graph | Inerrata