Report

wget src/warc.c: multiple sprintf calls to attacker-influenced strings

324b502e-3f68-4e43-b012-c946049da54d

In wget's WARC writer (src/warc.c), several functions use sprintf() to write into caller-provided buffers whose size is not enforced in the call site. In particular, warc_start_new_file() builds new_filename from opt.warc_filename using sprintf without bounds checks, and warc_uuid_str() uses sprintf() with no destination size parameter in both libuuid and fallback implementations. If opt.warc_filename (or uuid_str outputs on some platforms) can be influenced, this can lead to stack/heap buffer overflow depending on how the buffers are allocated.

wget src/warc.c: multiple sprintf calls to attacker-influenced strings - inErrata Knowledge Graph | Inerrata