With scl-utils-20111214-1.fc16:

1. 
> $ perl -e 'print "A"x65535' | valgrind ./scl -
> ==8187== Memcheck, a memory error detector
> ==8187== Copyright (C) 2002-2010, and GNU GPL'd, by Julian Seward et al.
> ==8187== Using Valgrind-3.6.1 and LibVEX; rerun with -h for copyright info
> ==8187== Command: ./scl -
> ==8187== 
> ==8187== Syscall param read(buf) points to unaddressable byte(s)
> ==8187==    at 0x35C58E26D0: __read_nocancel (in /lib64/libc-2.14.90.so)
> ==8187==    by 0x35C5878B41: _IO_file_xsgetn (in /lib64/libc-2.14.90.so)
> ==8187==    by 0x35C586CFE2: fread (in /lib64/libc-2.14.90.so)
> ==8187==    by 0x400B48: ??? (in /home/mitr/scl)
> ==8187==    by 0x35C582169C: (below main) (in /lib64/libc-2.14.90.so)
> ==8187==  Address 0x4c2c080 is 0 bytes after a block of size 8,192 alloc'd
> ==8187==    at 0x4A075B2: realloc (vg_replace_malloc.c:525)
> ==8187==    by 0x400B22: ??? (in /home/mitr/scl)
> ==8187==    by 0x35C582169C: (below main) (in /lib64/libc-2.14.90.so)

(Probably no security impact.)

Cause:
> for (;(r += fread(cmd+r, 1, BUFSIZ, stdin));) {
...
>     cmd = realloc(cmd, r);

needs to allocate BUFSIZ more to allow for the fread() in next iteration.


2.
> $ echo | valgrind ./scl -
> ==8257== Memcheck, a memory error detector
> ==8257== Copyright (C) 2002-2010, and GNU GPL'd, by Julian Seward et al.
> ==8257== Using Valgrind-3.6.1 and LibVEX; rerun with -h for copyright info
> ==8257== Command: ./scl -
> ==8257== 
> ==8257== Conditional jump or move depends on uninitialised value(s)
> ==8257==    at 0x4A07DB8: strlen (mc_replace_strmem.c:282)
> ==8257==    by 0x4010CA: ??? (in /home/mitr/scl)
> ==8257==    by 0x400D9A: ??? (in /home/mitr/scl)
> ==8257==    by 0x35C582169C: (below main) (in /lib64/libc-2.14.90.so)
> ==8257== 
> /var/tmp/sclhVZ8Gm: řádek 1: chyba syntaxe poblíž neočekávaného tokenu „null“
> /var/tmp/sclhVZ8Gm: řádek 1: `scl_enabled (null)'

Cause: argc not checked if (stdin_read)


3.
Nothing removes "tmp" (/var/tmp/sclXXX)