In common/execute.c, line 354, I found these lines: binding =3D dmalloc (sizeof *binding, MDL); memset (binding, 0, sizeof *binding); if (!binding) { Here, the pointer "binding" is passed to memset() unchecked. --=20 M=E5ns Rullg=E5rd mru at inprovide.com