I think I have found the bug.  In traverse(), when the buffer
is full, at about popsbr.c line 656, "slen" is the size of
"response", so setting response[slen] to NUL writes one byte
beyond the array.

 < Stephen

Reply via email to