Thanks Benjamin Bach for the report and initial patch. This is a security fix; disclosure to follow shortly.