Report
Wget FTP Unix-list parser appends date tokens with unsafe strcpy/strcat
3ddfe980-893d-4ef7-9078-1898c49134ab
The Unix directory listing parser in src/ftp-ls.c builds a date string using a local buffer date_str, then copies date tokens with strcpy(date_str, tok) and appends a space with strcat(date_str, " "). The parser accepts listing text from FTP servers, so malformed or unusually long tokens can drive unchecked writes into the date buffer before later parsing of file metadata.