problematic code:
...
                /* sizeof(char) is one by definition - but nevermind */
                buffer = (char*)malloc(sizeof(char)*(length + 1));
                buf = &buffer;
                freeMe = buffer;
                FS_Read(buffer, length, &file);
                
                /* buffer seems to point to some uninitialized memory */
                /*printf("buffer=[%s]",buffer);*/
                /* *buf appears to point to some uninitalized memory */
                /*printf("**buf=[%c]",**buf);*/
                tbuf = *buf;
                tc = *tbuf++;
                while(tc) {                                    /* <- sv_main.c:896 */
                        printf("\'%c\'[%d]", tc, (int)tc);
                        if (tbuf == &buffer[length-1]) {
                                tc = '+';
                        } else {
                                tc = *tbuf;
                        }
                        tbuf++;
                }   
 
                do {
                        tokenMap = COM_Parse(buf);            /* <- sv_main.c:907 */
...

related console output:
...
'/'[47]'*'[42]'
'[10]' '[32]'*'[42]' '[32]'m'[109]'a'[97]'p'[112]'c'[99]'y'[121]'c'[99]'l'[108]'e'[101]' '[32]'f'[102]'o'[111]'r'[114]' '[32]'U'[85]'F'[70]'O'[79]':'[58]'A'[65]'I'[73]' '[32]'s'[115]'e'[101]'r'[114]'v'[118]'e'[101]'r'[114]'
'[10]' '[32]'*'[42]' '[32]'f'[102]'o'[111]'r'[114]'m'[109]'a'[97]'t'[116]':'[58]'
'[10]' '[32]'*'[42]' '[32]'-'[45]'-'[45]'-'[45]'-'[45]'-'[45]'-'[45]'-'[45]'-'[45]'-'[45]'-'[45]'-'[45]'-'[45]'-'[45]'-'[45]'-'[45]'
'[10]' '[32]'*'[42]' '[32]'['[91]'m'[109]'a'[97]'p'[112]'n'[110]'a'[97]'m'[109]'e'[101]']'[93]' '[32]'['[91]'g'[103]'a'[97]'m'[109]'e'[101]'t'[116]'y'[121]'p'[112]'e'[101]']'[93]'
'[10]' '[32]'*'[42]'/'[47]'
'[10]'
'[10]'i'[105]'n'[110]'d'[100]'u'[117]'s'[115]'t'[116]'r'[114]'i'[105]'a'[97]'l'[108]'0'[48]'6'[54]'n'[110]' '[32]'c'[99]'o'[111]'o'[111]'p'[112]'2'[50]'
'[10]'i'[105]'t'[116]'a'[97]'l'[108]'y'[121]'0'[48]'5'[53]'d'[100]' '[32]'1'[49]'o'[111]'n'[110]'1'[49]'
'[10]'f'[102]'a'[97]'r'[114]'m'[109]'0'[48]'8'[56]'n'[110]' '[32]'c'[99]'o'[111]'o'[111]'p'[112]'3'[51]'
==31091== Conditional jump or move depends on uninitialised value(s)
==31091==    at 0x48EC29: SV_ParseMapcycle (sv_main.c:896)
==31091==    by 0x48F51D: SV_Init (sv_main.c:1144)
==31091==    by 0x47A6D3: Qcommon_Init (common.c:1552)
==31091==    by 0x49D7F6: main (sys_linux.c:538)
==31091== 
==31091== Conditional jump or move depends on uninitialised value(s)
==31091==    at 0x4959B3: COM_Parse (q_shared.c:1641)
==31091==    by 0x48EC33: SV_ParseMapcycle (sv_main.c:907)
==31091==    by 0x48F51D: SV_Init (sv_main.c:1144)
==31091==    by 0x47A6D3: Qcommon_Init (common.c:1552)
==31091==    by 0x49D7F6: main (sys_linux.c:538)
==31091== 
==31091== Conditional jump or move depends on uninitialised value(s)
==31091==    at 0x495984: COM_Parse (q_shared.c:1642)
==31091==    by 0x48EC33: SV_ParseMapcycle (sv_main.c:907)
==31091==    by 0x48F51D: SV_Init (sv_main.c:1144)
==31091==    by 0x47A6D3: Qcommon_Init (common.c:1552)
==31091==    by 0x49D7F6: main (sys_linux.c:538)
'[10]..added 3 maps to the mapcycle
...