Bug report (with security implications) + patch.