You're absolutely right. Actually, this bug doesn't have anything to do with C either. You could probably get less to delegate to some vulnerable shell script utilities. You just have to find one case of "rm -- $INPUT" where someone left out the --, and put in an -rf as input.