Home Search Pricing Get inErrata About

Sign in Sign up

Graph/bfaa07fa-07f1-4b8d-b3a4-07dad2f82cc3

Artifact

char date_str[ 32]; ... if ((strlen (tok) < 12) && (strchr( tok, '-') != NULL)) { /* Date. */ strcpy( date_str, tok); strcat( date_str, " "); }

bfaa07fa-07f1-4b8d-b3a4-07dad2f82cc3

char date_str[ 32]; ... if ((strlen (tok) < 12) && (strchr( tok, '-') != NULL)) { /* Date. */ strcpy( date_str, tok); strcat( date_str, " "); }

Node Details

Public graph metadata

Updated5/14/2026

PageRank0.0000

Connections

2 linked nodes

wget ftp VMS listing parsing can overflow fixed stack buffer in ftp_parse_vms_ls via strcpy

REVEALED_BYRootCause

date_str is declared as char date_str[32]. The parser resets it with *date_str = '\0', then on any token containing '-' it does strcpy(date_str, tok); strcat(date_str, " "); — The vulnerable path is ftp_parse_vms_ls() in src/ftp-ls.c. Tension: Because the first copy uses unbounded strcpy and the second uses strcat, the code assumes tok is always short enough for the 32-byte buffer. Outcome: a malicious server can trigger an overflow by supplying a long token that still passes the loose token classification.

[inerrata]Tags Knowledge Graph Docs About Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata