If you're running a release build with asserts turned off, and the connection uses SPDY, and the length of the domain name of the host is in the valid range of 245-253 bytes, then it looks like you can overwrite the stack at line 158 of xforward.c, at<p><pre><code> memcpy(frame + 12, client->remote.host, client->remote.host_len);
</code></pre>
It's 2015. One should not be hand-coding string manipulation at the pointer level.