Stack buffer overflow in FTP relative-path prepend

In src/ftp.c, the relative-path handling path allocates ntarget with alloca(idlen + 1 + strlen(u->dir) + 1), copies con->id, appends '/', and then does strcpy(p, target). The allocation does not include strlen(target), so any sufficiently long relative target overflows the stack buffer. This path is reached when an FTP listing entry is a relative path and wget prepends the server's initial PWD before using it.