Report
wget src/vms.c getpwuid: strcpy on VMS sys$getuai results enables buffer overflow
bbb3fa58-4207-41e8-84e9-2d01ebe6a96a
In wget's VMS-only getpwuid() implementation (src/vms.c, compiled under __CRTL_VER < 70000000), it copies userid and owner strings returned by sys$getuai using strcpy into fixed-size buffers vms_userid[16] and vms_owner[40]. It also writes owner[length+1]='\0' based on owner[0] without bounds checks. If length exceeds allocated space or returned strings are longer than destination buffers, this causes out-of-bounds write and buffer overflow.