MOF_Buffer::append(const char *, size_t) in mof/MOF_Buffer.cpp does not check for integer overflow in the size computation. _round_capacity(MOF_uint32) and _next_pow_2(MOF_uint32) have wrong arugment types, they need to be size_t.

MOF_unescape(const char *) in mof/MOF_String.cpp can overflow the result buffer.

These functions are only used by the code generator, and not at run time, so these bugs should be harmless.