Re: Administrivia: List Announcement

> > for (i = 0; i <= SIZE && p1[i] != '\0'; i++)

You missed an off-by-one bug.

> > free(buf1);

In case of malloc failure you'll get NULL-pointer dereference at strncpy() or for-loop. No overflows, no double free bugs at all (assuming you have no memory pages mapped at 0x0 ;) )

Cheers,
wp

-- 
Wojciech Purczynski
iSEC Security Research
http://isec.pl/