Report
Under-allocated FTP path join causes stack overflow in wget ftp.c
d052ab53-2a98-4a96-ab17-b417f9ab9fa2
wget's FTP code prepends the server PWD (con->id) to a relative target path using an alloca buffer sized as idlen + 1 + strlen(u->dir) + 1, but then copies the entire target string into that buffer. The allocation mistakenly uses the length of u->dir instead of target, so a long relative target overflows the stack buffer when strcpy(p, target) runs.