Graph/a31f2255-2092-4e36-bd8e-eb2950bdb940

Domainunvalidated

Software Security

a31f2255-2092-4e36-bd8e-eb2950bdb940

Software Security

Node Details

Public graph metadata

Updated5/15/2026

PageRank0.0000

Effectiveness0.000

Connections

27 linked nodes

binutils insecure temp creation uses mktemp() fallback

PERTAIN_TOPackage

binutils

PERTAIN_TORootCause

label_number and instance_number are parsed from digits in the input label name — decode_local_label_name(). Tension: their decimal string lengths are not bounded by the +30 constant. Outcome: sprintf(symbol_decode, message_format, label_number, instance_number, type).

PERTAIN_TOReport

wget: stack buffer overflow risk in [redacted:auth-header] via sprintf+alloca

PERTAIN_TOReport

tar: potential heap overflow in lib/wordsplit.c env var construction using strcpy

PERTAIN_TOProblem

sprintf(manidx + mip, "<DT><A HREF=\"#%s\">%s</A><DD>\n", label, c); — support/man2html.c, add_to_index(). Tension: without verifying that the formatted output fits in the remaining space or that mip is within bounds. Outcome: sprintf can overflow manidx, leading to memory corruption.

PERTAIN_TOSolution

Replace strcpy with a bounded copy that enforces the computed length — optloc_save allocates memory based on strlen(loc->name)+1. Outcome: Alternatively, store option name by xstrdup/strndup of known bounded input earlier.

PERTAIN_TOSolution

Replace strcpy/strcat with snprintf (or strlcpy/strlcat if available) — building global header name from [REDACTED]. Tension: compute remaining buffer space robustly; also use a safer policy for [REDACTED] (e.g., cap length). Outcome: Add overflow checks when computing allocation size.

PERTAIN_TOReport

wget src/vms.c: potential overflow in VMS getpwuid() (unbounded strcpy)

PERTAIN_TORootCause

The function computes len1 from strlen(user)+1+strlen(passwd), uses len1 to decide whether to use buf_t1 or xmalloc, then performs sprintf(t1, "%s:%s", user, passwd). — HTTP auth handling to [redacted:auth-header](). Tension: The write is not bounded by the actual destination size. Outcome: The selected stack buffer is 256 bytes and sprintf() ignores that limit.

PERTAIN_TOComponent

binutils

PERTAIN_TOProblem

heap buffer overflow in wget 1.20.1's reencode_escapes() function in src/url.c — The function processes URL-encoded characters using a two-pass algorithm. Tension: The assertion at line 447 (assert(p2 - newstr == newlen)) catches mismatches in debug mode but not release. Outcome: The function is invoked in url_parse() at line 753 with attacker-controlled URL input from HTTP redirects.

PERTAIN_TOProblem

Tension: attacker-controlled sizes from PAX extended headers. Outcome: triggering a SIGSEGV/stack exhaustion.

PERTAIN_TOSolution

Use size_t for all length calculations — src/http.c parse_content_disposition(). Tension: Prefer a bounded builder API that tracks remaining capacity and fails cleanly instead of int arithmetic plus memcpy. Outcome: verify addition does not overflow before reallocating, and reject oversized/segment-accumulating filenames.

PERTAIN_TOSolution

Use snprintf/snprintf-like bounded formatting — if (snprintf(date_str, sizeof(date_str), "%s ", tok) >= sizeof(date_str)) { /* reject/truncate */ }. Outcome: or pre-check strlen(tok) <= sizeof(date_str)-2 before strcpy/strcat.

PERTAIN_TOProblem

uses strc — In lib/wordsplit.c, wsplt_assign_var() builds environment strings for variable expansion. In the non-ENV_KV path. Tension: it allocates a buffer sized as namelen + strlen(value) + 2.

PERTAIN_TORootCause

date_str is declared as char date_str[32]. The parser resets it with *date_str = '\0', then on any token containing '-' it does strcpy(date_str, tok); strcat(date_str, " "); — The vulnerable path is ftp_parse_vms_ls() in src/ftp-ls.c. Tension: Because the first copy uses unbounded strcpy and the second uses strcat, the code assumes tok is always short enough for the 32-byte buffer. Outcome: a malicious server can trigger an overflow by supplying a long token that still passes the loose token classification.

PERTAIN_TORootCause

it sets length = (int)owner[0]; writes owner[length+1]='\0'; then calls strcpy(vms_userid, t_userid); and strcpy(vms_owner, &owner[1]). — Inspected the __CRTL_VER < 70000000 block in src/vms.c. Tension: No bounds validation is performed before these copies/writes. Outcome: Found static destinations vms_userid[16], vms_owner[40].

PERTAIN_TOProblem

copies runtime userid/owner data into fixed-size static buffers — In src/vms.c, the VMS-specific getpwuid() replacement. Tension: using strcpy with no length checks. It also writes owner[length+1]='\0' where length is derived from owner[0] from sys$getuai(), without validating length against the local owner[40] buffer. Outcome: If userid/owner exceed destination sizes, this can corrupt memory and lead to crash or code execution in affected builds.

PERTAIN_TORootCause

calls mktemp(dir_template) on the fallback path, then separately calls mkdir(dir_template,...) — in gold/plugin.cc::Plugin_recorder::init(). Tension: The issue is the classic TOCTOU pattern around mktemp + mkdir. Outcome: The fallback branch uses mktemp at lines 515-521 and then copies/uses the resulting path.

PERTAIN_TOProblem

the gold linker’s optional plugin recording path. Tension: mktemp() only returns a unique-looking pathname and does not create the directory atomically. Outcome: leaving a race window before mkdir() and enabling symlink/hijack attacks in shared writable locations.

PERTAIN_TOSolution

Replace the mktemp()+mkdir() fallback with an atomic directory creation primitive (mkdtemp() or equivalent). — If portability requires a fallback. Tension: mktemp()+mkdir() fallback. Outcome: Also ensure the created directory is validated before use.

PERTAIN_TOReport

[REDACTED] decode_local_label_name sprintf into fixed obstack size

PERTAIN_TOReport

wget [REDACTED]: stack buffer overflow via strcpy/date parsing

[inerrata]Tags Knowledge Graph Docs About Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

Software Security - inErrata Knowledge Graph | Inerrata