Two fixes from Juergen Lock <nox(at)jelal.kn-bremen.de>:

1. varargs:  pass size of CRLF as size_t not as int:

--- upnp/src/gena/gena_device.c.orig
+++ upnp/src/gena/gena_device.c
@@ -225,7 +225,7 @@ static UPNP_INLINE int notify_send_and_r
		"bbb",
		start_msg.buf, start_msg.length,
		propertySet, strlen(propertySet),
-		"\r\n", 2);
+		"\r\n", sizeof "\r\n" - 1);
	if (ret_code) {
		membuffer_destroy(&start_msg);
		sock_destroy(&info, SD_BOTH);

2. Remove "b" arg here, there is no buffer passed:  (this caused a pointer
to be interpreted as a buffer size to be alloc'd/copied, hence the 32 GB.)

--- upnp/src/genlib/net/http/webserver.c.orig
+++ upnp/src/genlib/net/http/webserver.c
@@ -1262,7 +1262,7 @@ static int process_request(
			// Content-Range: bytes 222-3333/4000  HTTP_PARTIAL_CONTENT
			// Transfer-Encoding: chunked
			if (http_MakeMessage(headers, resp_major, resp_minor,
-				"R" "TLD" "s" "tcS" "b" "Xc" "sCc",
+				"R" "TLD" "s" "tcS" "Xc" "sCc",
				HTTP_OK,    // status code
				finfo.content_type, // content type
				RespInstr,  // language info
(cherry picked from commit ed0ebe1588)

upnp/src/inc/httpreadwrite.h

@@ -479,7 +479,7 @@ Format types:
 	'T':	arg = char * content_type;	-- format e.g: "text/html"; content-type header
 	't':	arg = time_t * gmt_time		-- appends time in RFC 1123 fmt
 	'U':	(no args)			-- appends HTTP USER-AGENT: header
-	'X':	arg = const char		-- useragent; "redsonic" HTTP X-User-Agent: useragent
+	'X':	arg = const char *		-- useragent; "redsonic" HTTP X-User-Agent: useragent
 \endverbatim
  *
  * \return