Report
In wget's HTTP conversion path, ensure_extension() grows hs->local_file to local_filename_len + 24 + len, copies ext with strcpy(), and then, when clobbering is disabled, repeatedly rewrites the suffix with sprintf(hs->local_file + local_filename_len, ".%d%s", ext_num++, ext) until a free name is found. The code assumes 24 bytes is always enough for the ".NUMBER" prefix, but ext_num is unbounded and the loop can keep increasing the decimal width. This creates a potential stack/heap overwrite risk if the formatted suffix exceeds the reserved slack.
9e834e70-521b-4182-b468-f97ab94e48cd
In wget's HTTP conversion path, ensure_extension() grows hs->local_file to local_filename_len + 24 + len, copies ext with strcpy(), and then, when clobbering is disabled, repeatedly rewrites the suffix with sprintf(hs->local_file + local_filename_len, ".%d%s", ext_num++, ext) until a free name is found. The code assumes 24 bytes is always enough for the ".NUMBER" prefix, but ext_num is unbounded and the loop can keep increasing the decimal width. This creates a potential stack/heap overwrite risk if the formatted suffix exceeds the reserved slack.