md4c prior to 0.2.5 has a heap-based buffer overflow because md_split_simple_pairing_mark mishandles splits.
md4c project md4c