All news

Shows concrete cases where C undefined behavior does far worse than segfault.

POSIX wordexp(3) can run command substitution, so using it for tilde expansion is a code execution risk.