Finally found the exploit location.  Do research on how the comma operator works in C.  Line 121 in fusion05