String HHVM_FUNCTION(ldap_escape,
                     const String& value,
                     const String& ignores /* = "" */,
                     int flags /* = 0 */) {
  char esc[256] = {};

  if (flags & k_LDAP_ESCAPE_FILTER) { // llvm.org/bugs/show_bug.cgi?id=18389
    esc['*'*1u] = esc['('*1u] = esc[')'*1u] = esc['\0'*1u] = esc['\\'*1u] = 1;
  }

  if (flags & k_LDAP_ESCAPE_DN) {
    esc[','*1u] = esc['='*1u] = esc['+'*1u] = esc['<'*1u] = esc['\\'*1u] = 1;
    esc['>'*1u] = esc[';'*1u] = esc['"'*1u] = esc['#'*1u] = 1;
  }

  if (!flags) {
    memset(esc, 1, sizeof(esc));
  }

  for (int i = 0; i < ignores.size(); i++) {
    esc[(unsigned char)ignores[i]] = 0;
  }

  char hex[] = "0123456789abcdef";

  String result(3 * value.size(), ReserveString);
  char *rdata = result.get()->mutableData(), *r = rdata;

  for (int i = 0; i < value.size(); i++) {
    auto c = (unsigned char)value[i];
    if (esc[c]) {
      *r++ = '\\';
      *r++ = hex[c >> 4];
      *r++ = hex[c & 0xf];
    } else {
      *r++ = c;
    }
  }

  result.setSize(r - rdata);
  return result;
}
The software writes data past the end, or before the beginning, of the intended buffer.