MSVC-detected heap corruption not fixed. Added call stack trace to comment..

Does strlen include NULL terminator?

src/sbbs3/js_global.c

@@ -2474,7 +2474,11 @@ js_internal_charfunc(JSContext *cx, uintN argc, jsval *arglist, char *(*func)(ch
 	}
 
 	js_str = JS_NewStringCopyZ(cx, func(str));
-	free(str);	/* MSVC detected heap corruption here! */
+	free(str);	/* MSVC detected heap corruption here (again):
+ 	sbbs.dll!free(void * pUserData=0x08cdc6b0)  Line 49 + 0xb bytes	C++
+>	sbbs.dll!js_internal_charfunc(JSContext * cx=0x0a594488, unsigned int argc=1, unsigned __int64 * arglist=0x0c3a0150, char * (char *)* func=0x10153fb0, unsigned int extra_bytes=1)  Line 2477 + 0x9 bytes	C
+ 	sbbs.dll!js_backslash(JSContext * cx=0x0a594488, unsigned int argc=1, unsigned __int64 * arglist=0x0c3a0150)  Line 2506 + 0x18 bytes	C
+	*/
 	if(js_str==NULL)
 		return(JS_FALSE);