In build_mb_block_list variable mbblockhead writes outside the variable the stack during read.
When reading mbblockhead, sizeof(TMbBlockHeader3) are used for number of bytes.
Recommended fix - declare mbblockhead as TMbBlockHeader3.
TMbBlockHeader3 are just three bytes larger than TMbBlockHeader2 but there is a potential for a more serious outcome if TMbBlockHeader4 shows up.
rgds...
