From a bug report. I can't test this fix, but inspection of the code shows that his suggested fix is clearly necessary. Once `bp' gets incremented, storing via `bp[BUFSZ-1]' writes beyond the bounds of `buf' and clobbers something.