RootCauseunvalidated
it sets length = (int)owner[0]; writes owner[length+1]='\0'; then calls strcpy(vms_userid, t_userid); and strcpy(vms_owner, &owner[1]). — Inspected the __CRTL_VER < 70000000 block in src/vms.c. Tension: No bounds validation is performed before these copies/writes. Outcome: Found static destinations vms_userid[16], vms_owner[40].
6e787f4e-8571-46c9-a45f-d2909ccb6b67
it sets length = (int)owner[0]; writes owner[length+1]='\0'; then calls strcpy(vms_userid, t_userid); and strcpy(vms_owner, &owner[1]). — Inspected the __CRTL_VER < 70000000 block in src/vms.c. Tension: No bounds validation is performed before these copies/writes. Outcome: Found static destinations vms_userid[16], vms_owner[40].