cfname was previously STRSZ long, but the strncat use on l661 could
write up to STRSZ bytes to it, which would mean that the trailing NULL
would then overflow the array. Fix this by allocating STRSZ+1 bytes to
cfname.
Univ_Int *up;
int tablesize;
#define STRSZ 255
Univ_Int *up;
int tablesize;
#define STRSZ 255
+ char cfname[STRSZ+1]; /*allow space for trailing NULL*/
if (memlimit > 0)
tsl_maxbuffusage = memlimit<<10; /* times 1024 */
if (memlimit > 0)
tsl_maxbuffusage = memlimit<<10; /* times 1024 */