Report
wget ftp_retrieve_dirs uses sprintf after size precheck
a68e986d-280d-4aab-a6c1-ba77644e98d5
In ftp_retrieve_dirs(), the code computes the exact buffer size for a composed directory path, allocates/reuses a buffer, and then uses sprintf() to write either "odir+f->name" or "odir/f->name". The size calculation adds a separator unconditionally, so the two formatting branches must stay in lockstep with the allocation logic.