heap corruption after call to select() [modified]

[aliusam]

hi all i am writing a thread per client server, well its not really a server, but it destributes jobs and calculations to other connected PCs. i have been having this error Free Heap block 00DB3D28 modified at 00DB3D78 after it was freed Windows has triggered a breakpoint now i traced the corruption of the heap by using _heapchk() and i found that the heap is being corrupted after a call to select() with fd_set containing one socket to check it for readability, the call to _heapchk() befor the select() returns _HEAPOK and after the select() it returns _HEAPBADNODE. the call to select() is inside the client specific thread, the first client that connects has no problem at all, when a second client connects the select() works fine untill there are nothing to read from the socket, call select() and returns zero then the heap corrupts, how to solve such a problem where the code is not under my control???? i am using VC++ 2005 and win xp. another thing, the thread proc is part of an object, that is creating a thread by calling a static function passing pointer to an object and inside the static function call a member function of object, dose that effect the heap in any way harmful??? i used to do it all the time with no problems. here is the thread code:

thread(void* pParam)
{
int bytesSent,bytesToBeSent;
int bytesRecv = SOCKET_ERROR;
char sendbuf[4096] = "";
char recvbuf[4096] = "";
char tempbuf[4096] = "";

// tell client to send its status
short\* aa = (short\*) &sendbuf\[0\];
\*aa = PGA\_CMD\_SENDSTATE;
bytesToBeSent = 2;
bytesSent = send( socket, sendbuf, bytesToBeSent, 0 );
aa=NULL;

NotCritical = true;

/////// loop
int cmd,i,j,s,ret = 0;
TIMEVAL t;
t.tv\_sec=0;
t.tv\_usec=5000;
fd\_set fd;


while( 1 )
{
	FD\_ZERO(&fd);
	FD\_SET(socket,&fd);

	int hs2 = \_heapchk();      // hs2 = \_HEAPOK

	ret = select(0, &fd, NULL, NULL, &t);

	hs2 = \_heapchk();         // hs2 = \_HEAPBADNODE

	if ( ret > 0 )
	{
		s=0;
		bytesRecv = recv( socket, recvbuf, 4096, 0);
		if(bytesRecv == SOCKET\_ERROR)
			goto ERR;
		cmd = \*(short\*)recvbuf;
		j=2;
		switch(cmd)
		{
		//////////here we process recv data
		}// end switch(cmd)

	}
	else	// if ( ret > 0 )
	{
		if( ret < 0)
			goto ERR;
	}


}

ERR:
closesocket(socket);
state |= CI_STATE_ERROR;
isBad = true;
return 0;
}

any ideas?????? if i comment out the line

// ret = select(0, &fd, NULL, NULL, &t);

[Cosmic Egg]

try using _heapwalk