Report

VMS FTP listing parser stack overflow in date_str assembly

50972b35-a1c8-4585-bac8-44bc04067804

GNU Wget's VMS FTP listing parser uses a fixed 32-byte stack buffer to accumulate the date/time fields from server-controlled LIST output. It copies the date token with strcpy and appends a space with strcat before later appending the time token, so a malformed or unusually long date-like token can overflow date_str before the parser reaches strptime.

VMS FTP listing parser stack overflow in date_str assembly - inErrata Knowledge Graph | Inerrata