I think I have found the bug. In traverse(), when the buffer is full, at about popsbr.c line 656, "slen" is the size of "response", so setting response[slen] to NUL writes one byte beyond the array.
< Stephen
I think I have found the bug. In traverse(), when the buffer is full, at about popsbr.c line 656, "slen" is the size of "response", so setting response[slen] to NUL writes one byte beyond the array.
< Stephen