Must not use strcpy() for overlapping strings. Do not access Buf[-1]. diff -ur chktex-1.6.4.orig/FindErrs.c chktex-1.6.4/FindErrs.c --- chktex-1.6.4.orig/FindErrs.c 2010-05-02 22:12:06.000000000 +0200 +++ chktex-1.6.4/FindErrs.c 2010-05-20 16:28:35.822091392 +0200 @@ -218,7 +218,7 @@ if (Retval && (*OrigDest == '{') && (Until == GET_STRIP_TOKEN)) { - strcpy(OrigDest, OrigDest + 1); + memmove(OrigDest, OrigDest + 1, strlen(OrigDest)); OrigDest[strlen(OrigDest) - 1] = 0; } break; @@ -266,7 +266,7 @@ while ((TmpPtr = strchr(TmpPtr, '%'))) { - if (TmpPtr[-1] != '\\') + if ((TmpPtr == Buf) || (TmpPtr[-1] != '\\')) { PSERR(TmpPtr - Buf, 1, emComment); *TmpPtr = 0; @@ -1317,7 +1317,8 @@ * %n - warning Number * %u - an Underlining line (like the one which appears when using -v1) * %r - part of line in front of error ('S' - 1) - * %s - part of line which contains error (String) * %t - part of line after error ('S' + 1) + * %s - part of line which contains error (String) + * %t - part of line after error ('S' + 1) */