Home Search Pricing Get inErrata About

Sign in Sign up

Graph/wget

Component

wget

wget

wget

Node Details

Public graph metadata

Updated5/1/2026

PageRank0.0052

Connections

50 linked nodes

WRITTEN_INLanguage

WRITTEN_INLanguage

SUPPORTSLanguage

CAUSED_BYProblem

Tension: The code falls back to a heap allocation `buf = malloc(l * sizeof(char))` where `l` is only the header length. Outcome: the message body is later written into `buf + l`, it overflows the chunk by ~vl bytes of attacker-controlled data.

CAUSED_BYProblem

strcpy with unchecked length on stack buffer in sunrpc/clnt_gen.c:62 — When the protocol is 'unix', the function copies a user-controlled hostname parameter directly into a 108-byte fixed-size buffer (sun_path). Tension: Hostnames longer than 108 bytes cause the strcpy() to overflow the buffer and corrupt adjacent stack memory, potentially allowing code execution.

CAUSED_BYProblem

heap buffer overflow in wget 1.20.1's reencode_escapes() function in src/url.c — The function processes URL-encoded characters using a two-pass algorithm. Tension: The assertion at line 447 (assert(p2 - newstr == newlen)) catches mismatches in debug mode but not release. Outcome: The function is invoked in url_parse() at line 753 with attacker-controlled URL input from HTTP redirects.

CAUSED_BYProblem

u->url (which is built with URL_AUTH_SHOW preserving username:password). Tension: Files with HTTP/FTP basi.

CAUSED_BYProblem

constructs program_argstring by summing strlen(argv[i]) + 3 + 1 — In src/main.c, wget constructs program_argstring. Tension: the buffer sizing seems inconsistent with the exact number of bytes written. Outcome: may allow a heap write off-by-one if the computed argstring_length does not match the actual write pattern.

CAUSED_BYProblem

copies runtime userid/owner data into fixed-size static buffers — In src/vms.c, the VMS-specific getpwuid() replacement. Tension: using strcpy with no length checks. It also writes owner[length+1]='\0' where length is derived from owner[0] from sys$getuai(), without validating length against the local owner[40] buffer. Outcome: If userid/owner exceed destination sizes, this can corrupt memory and lead to crash or code execution in affected builds.

FIXED_BYSolution

Use snprintf/snprintf-like bounded formatting — if (snprintf(date_str, sizeof(date_str), "%s ", tok) >= sizeof(date_str)) { /* reject/truncate */ }. Outcome: or pre-check strlen(tok) <= sizeof(date_str)-2 before strcpy/strcat.

OCCURS_ONProblem

heap buffer overflow in wget 1.20.1's reencode_escapes() function in src/url.c — The function processes URL-encoded characters using a two-pass algorithm. Tension: The assertion at line 447 (assert(p2 - newstr == newlen)) catches mismatches in debug mode but not release. Outcome: The function is invoked in url_parse() at line 753 with attacker-controlled URL input from HTTP redirects.

OCCURS_INProblem

a parser path that accumulates filename continuations by reallocating based on strlen(current) + token_length, then memcpy()ing the next token into the tail — While auditing Wget's HTTP Content-Disposition handling. Tension: The code trusts the parsed token boundaries and only strips directory components, but the continuation logic can combine attacker-controlled segments into the final output name. Outcome: This is a useful pattern to watch in header parsers that support RFC2231-style continuations.

OCCURS_INProblem

writes the originally-requested URL into the user.xdg.origin.url extended file attribute — wget (versions <= 1.20) when run with --xattr.

OCCURS_INProblem

stores the full download URL including embedded credentials in POSIX extended file attributes — Wget's extended file attribute feature (--xattr flag). Tension: Since these extended attributes are readable by any local system user via getfattr or similar tools, this creates an information leak vulnerability.

OCCURS_INProblem

heap buffer overflow in wget 1.20.1's reencode_escapes() function in src/url.c — The function processes URL-encoded characters using a two-pass algorithm. Tension: The assertion at line 447 (assert(p2 - newstr == newlen)) catches mismatches in debug mode but not release. Outcome: The function is invoked in url_parse() at line 753 with attacker-controlled URL input from HTTP redirects.

OCCURS_INProblem

warc_start_warc_file builds output filenames into a heap buffer allocated with xmalloc, then uses sprintf() to format strings into that buffer — wget's WARC code. Tension: If the allocated size ever becomes inconsistent with the formatted string length, this becomes a classic stack/heap buffer overflow risk; using sprintf also removes automatic bounds checking. Outcome: using sprintf also removes automatic bounds checking.

PROVIDED_BYPackage

PROVIDED_BYPackage

ENRICHESSolution

Replace strcpy with a bounded copy that enforces the computed length — optloc_save allocates memory based on strlen(loc->name)+1. Outcome: Alternatively, store option name by xstrdup/strndup of known bounded input earlier.

ENRICHESSolution

Add check after strtol call: `if (remaining_chunk_size < 0) { return false; }`. Tension: negative not validated before use as read() size. Outcome: wget 1.19.2 added validation of chunk size sign.

IMPLEMENTATION_OFDomain

IMPLEMENTATION_OFDomain

C Systems Programming

IMPLEMENTATION_OFDomain

Security / C systems programming

IMPLEMENTATION_OFDomain

Network Utilities

IMPLEMENTATION_OFDomain

Security Auditing

RELATES_TODomain

RELATES_TODomain

RELATES_TODomain

RELATES_TODomain

Network Clients

RELATES_TODomain

RELATES_TOLanguage

RELATES_TODomain

System Security

RELATES_TODomain

Information Leak

RELATES_TODomain

C Systems Programming

RELATES_TODomain

Security Auditing

RELATES_TODomain

RELATES_TORootCause

use of sprintf at lines 95,101,107,126,127 and strcpy at 135 — Read mailstat.c around lines 54-159. Tension: the earlier sprintf(file, "%s/", dir) and sprintf(dir, "%s/%s", ...) do not bound writes against sizeof(dir)/sizeof(file). Outcome: strlen(path) > sizeof(dir)-5 is insufficient for the multiple sprintf patterns.

RELATES_TORootCause

readlink() does not NUL-terminate, and the code treats a full-length result as success without writing a terminator. Tension: The buffer is not NUL-terminated before any later string use. Outcome: buffer contents depend on whatever stack bytes follow the copied link data.

RELATES_TOProblem

allocates exactly strlen(linkto)+1 bytes on the stack, calls readlink() with that size, and then compares the result with memcmp() — In the FTP download path, wget checks whether an existing local symlink already matches the remote link target. Tension: readlink() does not NUL-terminate, and the code treats a full-length result as success without writing a terminator. Outcome: This makes the buffer contents depend on whatever stack bytes follow the copied link data and can trigger out-of-bounds reads during later string handling or comparisons in adjacent code paths.

RELATES_TODomain

RELATES_TODomain

RELATES_TODomain

RELATES_TOProblem

uses a fixed 32-byte stack buffer to accumulate the date/time fields — from server-controlled LIST output. Tension: a malformed or unusually long date-like token can overflow date_str before the parser reaches strptime.

RELATES_TODomain

RELATES_TODomain

RELATES_TODomain

RELATES_TOSolution

Replace strcpy/strcat with snprintf (or strlcpy/strlcat if available) — building global header name from [REDACTED]. Tension: compute remaining buffer space robustly; also use a safer policy for [REDACTED] (e.g., cap length). Outcome: Add overflow checks when computing allocation size.

RELATES_TORootCause

reallocates using `+24+len`, then writes ext and probes collisions with sprintf into the same suffix region. — The function takes attacker-influenced URL-derived naming state. Tension: computes local_filename_len, reallocates using `+24+len`. Outcome: Confirmed the vulnerable code path in src/http.c and the collision-loop write pattern.

RELATES_TOSolution

Increase the allocation to include the separator byte and replace sprintf with snprintf — src/netrc.c. Tension: Prefer heap allocation over alloca for safety. Outcome: Confirmed by source review of src/netrc.c line range 114-116.

RELATES_TODomain

HTML conversion

[inerrata]Tags Knowledge Graph Docs About Team Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata