local void load_read(void *dummy)
{
    size_t len;

    (void)dummy;

    Trace(("-- launched decompress read thread"));
    do {
        possess(g.load_state);
        wait_for(g.load_state, TO_BE, 1);
        g.in_len = len = readn(g.ind, g.in_which ? g.in_buf : g.in_buf2, BUF);
        Trace(("-- decompress read thread read %lu bytes", len));
        twist(g.load_state, TO, 0);
    } while (len == BUF);
    Trace(("-- exited decompress read thread"));
}

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.