####### Warning #1
../../src/convert.c: In function 'local_quote_string':
../../src/convert.c:806:1: warning: function may return address of
local variable [-Wreturn-local-addr]
806 | }
| ^
../../src/convert.c:745:8: note: declared here
745 | char buf[1024];
| ^~~
######
Proposed solution, remove buff completely, simplifying this function,
and eliminating any chance of leaking a stack variable.
###### Patch #1.
--- convert.c.orig 2024-03-11 15:59:02.000000000 -0700
+++ convert.c 2026-01-02 23:18:50.852180263 -0800
@@ -742,7 +742,6 @@
{
const char *from;
char *newname, *to, *res;
- char buf[1024];
size_t tolen;
char *any = strpbrk (file, "?#%; ");
@@ -752,10 +751,7 @@
/* Allocate space assuming the worst-case scenario, each character
having to be quoted. */
tolen = 3 * strlen (file);
- if (tolen < sizeof (buf))
- to = newname = buf;
- else
- to = newname = xmalloc (tolen + 1);
+ to = newname = xmalloc (tolen + 1);
for (from = file; *from; from++)
switch (*from)
@@ -794,13 +790,13 @@
}
*to = '\0';
- if (newname == buf)
- return no_html_quote ? strdup (newname) : html_quote_string (newname);
-
if (no_html_quote)
return newname;
res = html_quote_string (newname);
+ if (res == newname)
+ return newname;
+
xfree (newname);
return res;
}
#######
####### Warning #2
../../src/cookies.c: In function 'cookie_header':
../../src/cookies.c:1157:12: warning: argument 1 value
'18446744073709551615' exceeds maximum object size 9223372036854775807
[-Walloc-si
ze-larger-than=]
1157 | result = xmalloc (result_size);
| ^~~~~~~~~~~~~~~~~~~~~
In file included from ../../src/wget.h:155,
from ../../src/cookies.c:46:
../../lib/xalloc.h:59:7: note: in a call to allocation function
'xmalloc' declared here
59 | void *xmalloc (size_t s)
| ^~~~~~~
#######
There's already a zero count path out of this function, I propose
using it in one more spot in case the de-dup function goes a bit too
far.
####### Patch #2
--- cookies.c.orig 2026-01-02 21:39:46.467320282 -0800
+++ cookies.c 2026-01-02 21:55:52.807834367 -0800
@@ -1153,8 +1153,13 @@
name=value pairs -- result_size
"; " separators -- (count - 1) * 2
\0 terminator -- 1 */
+
+ if (!count) /* one last check that count isn't somehow zero */
+ goto out;
+
result_size = result_size + (count - 1) * 2 + 1;
result = xmalloc (result_size);
+
pos = 0;
for (i = 0; i < count; i++)
{
########
Adding these patches make for a warning free compile with gcc 14.3.
Thanks for maintaining wget!
