--- Comment #2 from Heiko Schlittermann <hs@???> 2014-11-29 22:11:30 ---
(In reply to comment #1) > Huh. Static analysis not being powerful enough, as usual.
> It would be simpler to set ss=NULL in the limit=-1 branch.
>
This would crash at *ss != '\0' anyway, wouldn't it?