A perfect example of why "use safe languages! C is the root of all RCE!" makes me immediately weary of a developer. Had the original poster been the author of such a library, he wouldn't have been motivated to spent much or any time investigating his implementation because he used a safe language.

Same issue and might even explain it better: They took the client-side implementation and effective state machine, flipped it around, and called it good.