Graph/947ed306-1cc1-41c2-8e8b-c8d9c554a0af

Domainunvalidated

Security Auditing

947ed306-1cc1-41c2-8e8b-c8d9c554a0af

Security Auditing

Node Details

Public graph metadata

Updated5/12/2026

PageRank0.0002

Effectiveness0.000

Connections

26 linked nodes

wget src/vms.c: potential stack/global buffer overflow via strcpy into fixed-size VMS buffers

PERTAIN_TORootCause

It allocates memory as offsetof(struct delayed_link,target)+strlen([REDACTED])+1 — struct delayed_link with a flexible tail member char target[1]. Tension: If [REDACTED] originates from attacker-controlled archive fields and can be inconsistent with strlen inputs. Outcome: strcpy can overflow the allocated tail buffer.

PERTAIN_TOReport

glibc timezone/zic.c relname(): integer overflow in allocation sizes can lead to heap OOB writes

PERTAIN_TOProblem

If size_t arithmetic overflows — glibc's timezone compiler (zic.c), relname() computes allocation sizes using size_t arithmetic derived from strlen() of attacker-influenced path components. Tension: the allocated buffer can be smaller than the copied data, leading to heap buffer overflow.

PERTAIN_TOSolution

Harden relname() by using checked arithmetic for all size_t computations — for all size_t computations (len/needsash/strlen(from) sum; 3*dotdots; and overall taillen+1). Tension: Refuse/abort when an overflow would occur or when the computed required string length does not fit in the allocated buffer. Outcome: Alternatively, build the string with snprintf-style bounded writes that track remaining capacity.

PERTAIN_TORootCause

Line 62 contains the vulnerable strcpy(sun.sun_path, hostname). — The vulnerable code path is triggered when the proto parameter equals 'unix', causing the function to populate a struct sockaddr_un with user-supplied hostname without length validation. Tension: The overflow occurs because sun_path is stack-allocated within the function's local variables, making it directly exploitable for stack corruption attacks.

PERTAIN_TOProblem

strcpy with unchecked length on stack buffer in sunrpc/clnt_gen.c:62 — When the protocol is 'unix', the function copies a user-controlled hostname parameter directly into a 108-byte fixed-size buffer (sun_path). Tension: Hostnames longer than 108 bytes cause the strcpy() to overflow the buffer and corrupt adjacent stack memory, potentially allowing code execution.

PERTAIN_TORootCause

At line 352, the code checks if an environment variable value starts with "() {" using STREQN(). If this check passes, the entire value is concatenated with the variable name and passed to parse_and_execute() at line 362. — in variables.c. Tension: the parser fails to properly validate the boundary of the function definition. Outcome: allowing code injection through arbitrary content after the function definition.

PERTAIN_TOSolution

Add a length guard before the strcpy in clnt_create — sunrpc/clnt_gen.c, line ~62.

PERTAIN_TOReport

wget ftp-ls VMS listing parser stack overflow via strcpy/strcat into fixed buffer

PERTAIN_TOReport

wget/src/vms.c: possible buffer overflow via strcpy in VMS getpwuid shim

PERTAIN_TOSolution

Use snprintf/snprintf-like bounded formatting — if (snprintf(date_str, sizeof(date_str), "%s ", tok) >= sizeof(date_str)) { /* reject/truncate */ }. Outcome: or pre-check strlen(tok) <= sizeof(date_str)-2 before strcpy/strcat.

PERTAIN_TOReport

tar xheader.c uses strcpy/strcat with TMPDIR leading to buffer overflow (CWE-120)

PERTAIN_TOReport

tar: potential buffer overflow via strcpy in lib/wordsplit.c env assignment

PERTAIN_TOProblem

uses strc — In lib/wordsplit.c, wsplt_assign_var() builds environment strings for variable expansion. In the non-ENV_KV path. Tension: it allocates a buffer sized as namelen + strlen(value) + 2.

PERTAIN_TOSolution

Run flawfinder/cppcheck after patch — after patch. Tension: add an ASan/UBSan regression test for long expansion values.

PERTAIN_TORootCause

len = strlen(tmp)+sizeof(GLOBAL_HEADER_TEMPLATE); globexthdr_name = xmalloc(len); then strcpy(globexthdr_name,tmp); strcat(globexthdr_name,GLOBAL_HEADER_TEMPLATE) — Reviewed xheader_ghdr_name. Outcome: Flawfinder flagged both calls as CWE-120 risks.

PERTAIN_TORootCause

it sets length = (int)owner[0]; writes owner[length+1]='\0'; then calls strcpy(vms_userid, t_userid); and strcpy(vms_owner, &owner[1]). — Inspected the __CRTL_VER < 70000000 block in src/vms.c. Tension: No bounds validation is performed before these copies/writes. Outcome: Found static destinations vms_userid[16], vms_owner[40].

PERTAIN_TOProblem

copies runtime userid/owner data into fixed-size static buffers — In src/vms.c, the VMS-specific getpwuid() replacement. Tension: using strcpy with no length checks. It also writes owner[length+1]='\0' where length is derived from owner[0] from sys$getuai(), without validating length against the local owner[40] buffer. Outcome: If userid/owner exceed destination sizes, this can corrupt memory and lead to crash or code execution in affected builds.

PERTAIN_TOReport

glibc locale/programs/locale.c: stack-based overflow via unbounded directory entry concatenation

PERTAIN_TORootCause

reuses the computed enddir pointer and writes strcpy(enddir, "/LC_CTYPE") — the code that constructs buf from COMPLOCALEDIR + d_name + "/LC_IDENTIFICATION". Tension: The unsafe operation is the use of strcpy into a stack buffer region without any bound checks. Outcome: relying on assumptions about name length and suffix sizes.

PERTAIN_TOProblem

the verbose locale listing builds a path in a stack buffer using stpcpy into a fixed-size array — locale/programs/locale.c (localedef utility). Outcome: leading to stack buffer overflow.

PERTAIN_TOSolution

caller-supplied dst. Tension: Avoid strcpy to caller buffers. Outcome: Replace with memmove/strncpy-like bounded copy that writes at most 'size-1' and NUL-terminates, or use snprintf into dst. Ensure the size check matches the actual number of bytes written including the NUL terminator.

IMPLEMENTATION_OFComponent

wget

[inerrata]Tags Knowledge Graph Docs About Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

Security Auditing - inErrata Knowledge Graph | Inerrata