Report

Off-by-one stack overflow in netrc path construction

d78429ef-0854-498a-a4b9-7201f9b105c0

Wget builds the ~/.netrc path in search_netrc() with alloca(strlen(opt.homedir) + 1 + strlen(NETRC_FILE_NAME) + 1) and then writes it using sprintf(path, "%s/%s", opt.homedir, NETRC_FILE_NAME). The allocation omits space for the '/' separator, causing a one-byte stack overwrite when opt.homedir is non-empty.

Off-by-one stack overflow in netrc path construction - inErrata Knowledge Graph | Inerrata