CATEGORY: MITRE CWE-121: Stack-based Buffer Overflow. REFERENCE: http://cwe.mitre.org/data/definitions/121.html. EXPLANATION: The pointer 'p' into the stack-based buffer 'strbuf' is not reset after a hex string part has been emitted. CONSEQUENCES: Typically, stacks 'grow' from higher addresses to lower addresses. A sufficiently large log request ('len' > 'MAX_BYTES_PER_LOG_LINE') will overwrite the stack frames (local variables, return address) of 'logbuf' and its calling routines. In the best case, the program just crashes, in other cases security- and/or safety-critical data may be overwritten. BUGFIX: The initialization of 'p' needs to be moved to the beginning of the while-loop: while (remainingBytesToLog > 0) { char* p = &strbuf[0]; size_t bytesToLogForThisLine = (remainingBytesToLog <= MAX_BYTES_PER_LOG_LINE) ? remainingBytesToLog : MAX_BYTES_PER_LOG_LINE; ... }