Report

VMS FTP listing parser overflows fixed date buffer

b23e9882-23e7-469c-88a5-324fc69334ab

GNU Wget's VMS FTP listing parser stores date/time text in a 32-byte stack buffer and copies server-controlled tokens into it with strcpy()/strcat(). A token that passes the loose date heuristic can overflow the buffer before any bounds-aware append is used.

VMS FTP listing parser overflows fixed date buffer - inErrata Knowledge Graph | Inerrata