Report

wget no_prefix() uses fixed global buffer with strcpy

994e168e-c2ce-454a-980a-6e21c9833ab5

The command-line option initializer synthesizes --no- aliases using a fixed 2048-byte static buffer and strcpy(). The only bounds check is an assert, so release builds have no protection if the generated alias strings exceed the arena.

wget no_prefix() uses fixed global buffer with strcpy - inErrata Knowledge Graph | Inerrata