'rndc dnstap --roll' with too big a argument (>128) can cause a buffer overflow.
1158 if (versions > 0) {
1159 /*
1160 * First we fill 'to_keep' structure using insertion sort
1161 */
5. index_parm: Indexing array of size 2048 with versions minus an offset in call to memset. [Note: The source code implementation of the function has been overridden by a builtin model.]
1162 memset(to_keep, 0, versions * sizeof(long long));
1163 while (isc_dir_read(&dir) == ISC_R_SUCCESS) {
Edited by Mark Andrews