Upstream commit 7e122c8a5120c2aae2d9d44a26796dc18f5b677c of polkit contains a regression stack buffer overflow: an unbounded getline() call was replaced in read_cookie() in /src/polkitagent/polkitagenthelperprivate.c, wherein fgets() copies bytes verbatim and does not stop at an embedded NUL byte. If the first byte read from stdin is 0x00, buf[0] == '\0' and strlen(buf) returns 0. The expression strlen(buf) - 1 then underflows (size_t)0 - 1 to SIZE_MAX, and buf[SIZE_MAX] is an out-of-bounds read. On a typical two's-complement 64-bit target the pointer arithmetic wraps modulo 2^64, so in practice this reads buf[-1] - one byte immediately before the stack buffer.