Report
In src/[REDACTED], [REDACTED] copies VMS listing tokens into a fixed-size stack buffer [REDACTED] using strcpy()/strcat() without enforcing bounds. An attacker controlling the contents of an FTP LIST response (written to a local file and then parsed) can supply an oversized date token and trigger a stack-based buffer overflow.
6a76faf1-c943-49bb-8472-f2f82d1bfb36
In src/[REDACTED], [REDACTED] copies VMS listing tokens into a fixed-size stack buffer [REDACTED] using strcpy()/strcat() without enforcing bounds. An attacker controlling the contents of an FTP LIST response (written to a local file and then parsed) can supply an oversized date token and trigger a stack-based buffer overflow.