The buffer was sized as floor(sz/4)*3 but the loop ran ceil(sz/4) times, writing 3 bytes per iteration. For sz%4!=0, this wrote past the buffer end. Also guarded sz<4 to avoid processing trivially short or malformed input.
andrey
8853d16826