On Wed, 14 May 2014, Kristian Amlie wrote:
> 
> In cf-serverd/tls_server.c:
> 
> > @@ -853,10 +853,62 @@ bool BusyWithNewProtocol(EvalContext *ctx, ServerConnectionState *conn)
> >          return true;
> >      }
> >      case PROTOCOL_COMMAND_MD5:
> > +    {
> > +        int ret = sscanf(recvbuffer, "MD5 %[^\n]", filename);
> 
> Same: Possible overflow?

This is obscure, but it has been like this all over the place in the 
server code: recvbuffer can never be more than 4K-1 long, populated by 
```ReceiveTransaction()```.