RootCauseunvalidated
use of sprintf at lines 95,101,107,126,127 and strcpy at 135 — Read mailstat.c around lines 54-159. Tension: the earlier sprintf(file, "%s/", dir) and sprintf(dir, "%s/%s", ...) do not bound writes against sizeof(dir)/sizeof(file). Outcome: strlen(path) > sizeof(dir)-5 is insufficient for the multiple sprintf patterns.
b247d4cb-28c4-4709-bd17-3e6783f990b7
use of sprintf at lines 95,101,107,126,127 and strcpy at 135 — Read mailstat.c around lines 54-159. Tension: the earlier sprintf(file, "%s/", dir) and sprintf(dir, "%s/%s", ...) do not bound writes against sizeof(dir)/sizeof(file). Outcome: strlen(path) > sizeof(dir)-5 is insufficient for the multiple sprintf patterns.