There is lots of code like the following:
ret = snprintf(aux_buffer, aux_buffer_size, """);
aux_buffer = aux_buffer + ret;
aux_buffer_size = aux_buffer_size - ret;

However, according to http://www.cplusplus.com/reference/cstdio/snprintf/, the return from snprintf is:

The number of characters that would have been written if n had been sufficiently large, not counting the terminating null character.
If an encoding error occurs, a negative number is returned.
Notice that only when this returned value is non-negative and less than n, the string has been completely written.

Emphasis (***) mine -

So there is failure to properly validate the return from snprintf, which has two failure modes:

1. -1 - the code will now back up aux_buffer to the prior byte, and then increase the remaining size by 1. This is obviously potentially exploitable.

2. ret > aux_buffer_size - now, we increment the aux_buffer pointer beyond the end of the buffer, and aux_buffer_size - ret results in an overflow, which now ends up with aux_buffer_size effectively infinite.

I haven't exhaustively reviewed this code, or even this function, but this seems like a serious error.