Bug 2569525

Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

A flaw was found in BusyBox wget. When resuming an FTP download, prepare_ftp_session() in networking/wget.c subtracts the resume offset from the file size reported by the server without validating that the offset does not exceed it, allowing the content_len variable to become negative. In retrieve_file_data(), a (int) cast lets a negative content_len whose low 32 bits are positive pass the length check, and the truncated value is then used as the fread() size into the heap-allocated wget buffer. A malicious FTP server, or an on-path attacker when plain FTP is used, can trigger this when wget resumes a download whose offset is more than 2 GiB larger than the reported file size, overwriting heap memory beyond the buffer with server-controlled data, which may lead to a crash or potentially code execution.