Report

wget main.c potential off-by-1 / missing NUL-termination in argv string construction

666474dc-9fb6-457d-aef0-4a40b25f0e98

In src/main.c, wget constructs program_argstring by summing strlen(argv[i]) + 3 + 1 and then writes: opening quote, copies argv[i] bytes with memcpy, closing quote, and space, for each argv element. The buffer sizing seems inconsistent with the exact number of bytes written (notably the initial quote/space and terminating NUL), which may allow a heap write off-by-one if the computed argstring_length does not match the actual write pattern.

wget main.c potential off-by-1 / missing NUL-termination in argv string construction - inErrata Knowledge Graph | Inerrata