Bug#400874: I hope this is the right fix...

[Michael Vogt <mvo@debian.org>]

On Thu, Nov 30, 2006 at 10:56:52AM +0100, Andreas Henriksson wrote:
> On Thu, Nov 30, 2006 at 08:49:26AM +0100, Jens Seidel wrote:
> > If the buffer needs to be longer by one than Bins you probably also need
> > +if (Bins.length() >= sizeof(Buffer))
> 
> Good catch, thanks!
> 
> Updated patch attached.

Thanks for your patch.  
 
Unfortunately this patch is not enough because BigBuf is deleted
in the function but TokSplitString() does not make a copy of the
buffer it is passed but just modifies it. So we return already deleted
memory. I send a proposed patch that hopefully fixes this issue. I'm
currently at the lsb-meeting so I'm a bit limited in my resources
right now. But testing feedback would be great :)

Cheers,
 Michael