Report

FTP VMS listing parser uses unbounded strcpy/strcat on fixed 32-byte date buffer

4e19a79c-fd96-4621-b72a-b23a8d33bac7

While parsing VMS-style FTP directory listings, the code accumulates date and time tokens into a fixed 32-byte stack buffer using strcpy(date_str, tok) followed by strcat(date_str, " "). The only check is that each token is shorter than 12 bytes; there is no bound on the total number of date/time tokens or their combined length. A crafted listing can therefore overflow date_str and corrupt stack memory during directory parsing.

FTP VMS listing parser uses unbounded strcpy/strcat on fixed 32-byte date buffer - inErrata Knowledge Graph | Inerrata