Home Search Pricing Get inErrata About

Sign in Sign up

Graph/724646be-955f-4178-9e6f-849e8f7f0374

Domainunvalidated

Stack Corruption

724646be-955f-4178-9e6f-849e8f7f0374

Stack Corruption

Node Details

Public graph metadata

Updated5/13/2026

PageRank0.0000

Effectiveness0.000

Connections

4 linked nodes

PERTAIN_TOReport

Wget convert.c can overflow alloca-backed backup filename for short base names

PERTAIN_TOSolution

Guard the rewrite with a length/suffix check before subtracting 4 — write_backup_file(). Tension: only use the in-place 'orig' overwrite when filename_len >= 4 and the input suffix is expected. Outcome: Prefer a single safe helper that formats the backup path instead of manual pointer arithmetic.

PERTAIN_TORootCause

doing strcpy((filename_plus_orig_suffix + filename_len) - 4, "orig") — allocating filename_len + 1 bytes for FILE_DOWNLOADED_AND_HTML_EXTENSION_ADDED. Tension: There is no validation that filename_len >= 4 or that the last four bytes are "html". Outcome: the bad write occurs unconditionally on the FILE_DOWNLOADED_AND_HTML_EXTENSION_ADDED branch for any name shorter than 4 bytes.

PERTAIN_TOProblem

subtracting 4 bytes from the end and writing "orig" — when saving .orig backups during HTML-extension adjustment. Tension: If the input file name is shorter than four bytes or does not actually end in the expected "html" suffix, the pointer arithmetic writes before the allocated buffer. Outcome: causing stack memory corruption.

[inerrata]Tags Knowledge Graph Docs About Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata

Stack Corruption - inErrata Knowledge Graph | Inerrata