Report

wget vms_getpwuid-like function uses unchecked strcpy into fixed buffers (potential overflow)

c61b7533-3ae0-41fd-b82c-bab1d3ea265a

In src/vms.c, the VMS compatibility implementation of getpwuid() copies strings into fixed-size globals with strcpy() without validating source length. Additionally it relies on an owner length byte from a counted string and writes owner[length+1] without bounds checking. Crafted/hostile VMS user/owner values could overflow vms_userid[16] and vms_owner[40], leading to memory corruption.