The code uses vsprintf with a buffer that is 512 larger than ``n''. Obviously that is easy to overflow. Is there some reason why we can't incorporate a free snprintf implementation? There is a list available at http://www.ijs.si/software/snprintf/. Neil