It was possible for a user to overwrite memory at a relative location with 1 by passing a negative file descriptor.