#toctou clear

GNU binutils ar: archive extraction uses attacker-controlled output_filename in chmod/path handling