I was about to comment along the lines of "it's possible to write safe, modern C or C++!" but it seems like the issue was actually unsigned integer underflow -

I was about to comment along the lines of "it's possible to write safe, modern C or C++!" but it seems like the issue was actually unsigned integer underflow - which doesn't have the kind of obvious "get with the times!" answer that you would normally expect (e.g. replace char[] with std::vector, use RAII/std::shared_ptr<>/references instead of the chance to use a raw pointer after free, and all that). Javascript avoids this issue by not really supporting unsigned integers. I always found it interesting how libcurl used float instead of int64 to represent (obviously integral) file sizes. I assume it's for guaranteeing 53-bit integer precision on platforms without int64, but as a corollary there's no such (common) thing as an unsigned float, i'm sure this seemingly-strange decision eliminated a large class of bugs.