Beta3: Tile Editor stack corruption

In t2dVector.cc:

//-----------------------------------------------------------------------------
// Normalise Rectangle (two 2D Vectors) with relation to each other.
//-----------------------------------------------------------------------------
ConsoleFunction( t2dRectNormalise, const char*, 3, 3, "(t2dVector v1$, t2dVector v2$) - Returns normalise rectangle of v1 and v2.")
{
// Check Parameters.
if ( t2dSceneObject::getStringElementCount(argv[1]) < 2 || t2dSceneObject::getStringElementCount(argv[2]) < 2 )
{
Con::warnf("t2dRectNormalise() - Invalid number of parameters!");
return NULL;
}

// Input Vectors.
t2dVector v1(0,0), v2(0,0);
// Scan-in vectors.
dSscanf(argv[1],"%f %f", &v1.mX, &v1.mY);
dSscanf(argv[2],"%f %f", &v2.mX, &v2.mY);
// Do Vector Operation.
t2dVector topLeft( (v1.mX <= v2.mX) ? v1.mX : v2.mX, (v1.mY <= v2.mY) ? v1.mY : v2.mY );
t2dVector bottomRight( (v1.mX > v2.mX) ? v1.mX : v2.mX, (v1.mY > v2.mY) ? v1.mY : v2.mY );

// Create Returnable Buffer.
char* pBuffer = Con::getReturnBuffer(32);
// Format Buffer.
dSprintf(pBuffer, 32, "%f %f %f %f", topLeft.mX, topLeft.mY, bottomRight.mX, bottomRight.mY);
// Return Velocity.
return pBuffer;
}

The size of the buffer is 32, but in the case I encountered the number of bytes written was 39 - "24.453125 19.686163 24.453125 19.686163"