Integer overflow in flush leads to buffer overflow.
vulners.com/securityvulns/securityvulns:doc:19618