corrupt revoke r_count buffer overflow