Jeremy's valgrind logs have had a couple of these recently, e.g., http://starurchin.org/dillo/valgrind/5b601af9ce7facc17690b88c4323c194fded01c... I found that - after dpidc stop - valgrind --leak-check=full --trace-children=yes dillo - going to http://jimbojw.com/wiki/index.php?title=Data_URI_Explained - and pasting in the second example (the percent-encoded one, not the base64 one) gets me: ==20817== Invalid read of size 4 ==20817== at 0x804AED5: dStr_insert_l (dlib.c:287) ==20817== by 0x804AFB5: dStr_append_l (dlib.c:308) ==20817== by 0x8049317: main (datauri.c:332) ==20817== Address 0x41cbbb0 is 0 bytes after a block of size 664 alloc'd ==20817== at 0x402AE29: realloc (vg_replace_malloc.c:662) ==20817== by 0x804A736: dRealloc (dlib.c:53) ==20817== by 0x804918B: datauri_get_data (datauri.c:273) ==20817== by 0x80492E1: main (datauri.c:324) ==20817== ==20817== ==20817== Process terminating with default action of signal 11 (SIGSEGV): dumping core Valgrind has options for debugging, but I haven't had any luck with getting them to work so far. I'm imagining that this might have to do with only being able to send part of the data at a time when everything's sluggish due to valgrind, but I don't know datauri/dpip well enough to go straight for the most likely spots... PS I don't trust the "by 0x8049317: main (datauri.c:332)" line because I have -O0, and sometimes it's had some 0x40... address instead that it describes as being below main. PPS I find myself wishing that we could have the dpis back in dillo.