ozten/sasl-browserid — comment on commit d2cbf17429acb201f60af2744265249581c0f04f
File: plugins/browserid.c line 95
By dchan:

Is serveroutlen used by the caller of _transmit_email? It's important to note whether the value is the number of bytes in the string or the count of characters. The former will have 1 additional byte due to the null terminator. That itself can result in off-by-1 errors if not properly documented. For the latter case, the +1 should be added in the malloc call.