Hi, If I do not mistake, cf_new_symbol() has incorrect check of symbol length. In other places where SYM_MAX_LEN is used, it is expected that leading zero is counted in it. But the check in cf_new_symbol() allows symbol length equal to SYM_MAX_LEN. This does not cause a problem (as I unederstand), because the space is allocated anyway and this string is not copied later to fixed size arrays. I attached a patch with the fix, there is also a couple of bsprintf replaced with safer bsnprintf calls.