Thanks for catching that. Obviously the patch should go in, but I'm mystified as to why we need two bytes' worth of sentinels after the buffer. I suspect there's another bug lurking in there, related to the bugs earlier in this report.

That is, the two-byte trailing sentinel seems to be related to the problem that the code that calls transit_state_singlebyte can jump over two bytes when it should jump past just one. The whole area is a bit of a mess. (For example, transit_state_singlebyte always returns the same value -- what's up with that!?)



Reply via email to