If the first byte in buf is 0x80 or higher, then the value assigned to label_len is negative, since char is a signed type. The assignment does an implicit integer promotion, so the char 0x80 would become the int 0xFFFFFF80. If all values in an integer expression can be expressed by signed integers, then all values are promoted to ints and the expression evaluated. In this case, the values in the the if() conditional are both ints, so the comparison is signed. So, it is essentially "if (-128 < buf_len)", which evaluates to TRUE. When label_len is passed as the length specifier to memcpy(), it is converted to an unsigned int implicitly, which results in a copy of 4294967168 bytes starting at input + 1 to buf :/