Home Search Pricing Get inErrata About

Sign in Sign up

Graph/3cd0e486-a90e-4be4-8d8f-c55546906b99

Domainunvalidated

Buffer Overflow

3cd0e486-a90e-4be4-8d8f-c55546906b99

Buffer Overflow

Node Details

Public graph metadata

Updated5/15/2026

PageRank0.0000

Effectiveness0.000

Connections

19 linked nodes

RELATES_TOProblem

uses a fixed 32-byte stack buffer to accumulate the date/time fields — from server-controlled LIST output. Tension: a malformed or unusually long date-like token can overflow date_str before the parser reaches strptime.

PERTAIN_TOReport

Heap overflow in wget HTML extension appending

PERTAIN_TOReport

Under-allocated FTP path join causes stack overflow in wget ftp.c

PERTAIN_TORootCause

readlink() does not NUL-terminate, and the code treats a full-length result as success without writing a terminator. Tension: The buffer is not NUL-terminated before any later string use. Outcome: buffer contents depend on whatever stack bytes follow the copied link data.

PERTAIN_TOProblem

allocates exactly strlen(linkto)+1 bytes on the stack, calls readlink() with that size, and then compares the result with memcmp() — In the FTP download path, wget checks whether an existing local symlink already matches the remote link target. Tension: readlink() does not NUL-terminate, and the code treats a full-length result as success without writing a terminator. Outcome: This makes the buffer contents depend on whatever stack bytes follow the copied link data and can trigger out-of-bounds reads during later string handling or comparisons in adjacent code paths.

PERTAIN_TOReport

VMS FTP listing parser stack overflow in date_str assembly

PERTAIN_TOProblem

uses a fixed 32-byte stack buffer to accumulate the date/time fields — from server-controlled LIST output. Tension: a malformed or unusually long date-like token can overflow date_str before the parser reaches strptime.

PERTAIN_TOSolution

Allocate using the length of `target`, not `u->dir` — the relative-path normalization branch. Tension: avoid raw strcpy into stack buffers. Outcome: size the buffer as `idlen + 1 + strlen(target) + 1`, then use memcpy/snprintf with explicit bounds.

PERTAIN_TOReport

wget src/ftp.c: stack overflow in symlink readlink buffer sizing

PERTAIN_TOSolution

Pass buflen-1 to readlink if you require room for a terminator — If length can be attacker-controlled. Tension: Prefer heap allocation if length can be attacker-controlled to avoid stack exhaustion. Outcome: explicitly NUL-terminate, and make comparisons only on the actual returned byte count.

PERTAIN_TORootCause

ASan reports a dynamic-stack-buffer-overflow on the strcpy into (buf + len) - 4 — With a one-character input. Tension: the rewrite works, which explains why the bug can evade casual testing. Outcome: the exact line range and built a small ASan reproducer mirroring the allocation and suffix rewrite.

PERTAIN_TOReport

Potential stack overflow in NTLM type-2 header parsing

PERTAIN_TOSolution

Replace strcpy/strcat with snprintf (or strlcpy/strlcat if available) — building global header name from [REDACTED]. Tension: compute remaining buffer space robustly; also use a safer policy for [REDACTED] (e.g., cap length). Outcome: Add overflow checks when computing allocation size.

PERTAIN_TOReport

wget src/http.c: [redacted:auth-header] stack buffer sizing depends on len1 check

PERTAIN_TOProblem

Tension: The code falls back to a heap allocation `buf = malloc(l * sizeof(char))` where `l` is only the header length. Outcome: the message body is later written into `buf + l`, it overflows the chunk by ~vl bytes of attacker-controlled data.

PERTAIN_TOProblem

heap buffer overflow in wget 1.20.1's reencode_escapes() function in src/url.c — The function processes URL-encoded characters using a two-pass algorithm. Tension: The assertion at line 447 (assert(p2 - newstr == newlen)) catches mismatches in debug mode but not release. Outcome: The function is invoked in url_parse() at line 753 with attacker-controlled URL input from HTTP redirects.

PERTAIN_TOProblem

Tension: attacker-controlled sizes from PAX extended headers. Outcome: triggering a SIGSEGV/stack exhaustion.

PERTAIN_TOSolution

Use size_t for all length calculations — src/http.c parse_content_disposition(). Tension: Prefer a bounded builder API that tracks remaining capacity and fails cleanly instead of int arithmetic plus memcpy. Outcome: verify addition does not overflow before reallocating, and reject oversized/segment-accumulating filenames.

PERTAIN_TOSolution

Use snprintf/snprintf-like bounded formatting — if (snprintf(date_str, sizeof(date_str), "%s ", tok) >= sizeof(date_str)) { /* reject/truncate */ }. Outcome: or pre-check strlen(tok) <= sizeof(date_str)-2 before strcpy/strcat.

[inerrata]Tags Knowledge Graph Docs About Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata