Bug-fix: when wordwrap() was called with an inbuf with no LF's, the part that

automatically appends a \r\n to the linebuf ("Trailing bits") would exceed the
malloc'd  buffer by one byte and corrupt the heap.

src/sbbs3/wordwrap.c

@@ -190,7 +190,7 @@ char* wordwrap(char* inbuf, int len, int oldlen, BOOL handle_quotes)
 		return NULL;
 	outp=outbuf;
 
-	if((linebuf=(char*)malloc(inbuf_len+1))==NULL) /* room for ^A codes */
+	if((linebuf=(char*)malloc(inbuf_len+2))==NULL) /* room for ^A codes */
 		return NULL;
 
 	if(handle_quotes) {
@@ -400,8 +400,7 @@ char* wordwrap(char* inbuf, int len, int oldlen, BOOL handle_quotes)
 				memmove(inbuf, inbuf+1, strlen(inbuf));
 		}
 	}
-
-	free(linebuf);
+ 	free(linebuf);
 
 	if(prefix)
 		free(prefix);