The lack of validation has at least three distinct consequences. Since there is no check
on the length of ftype, the buffer overflow (CWE-119) in lines 2 to 4 is possible. Since
there is no check of the contents of the ftype variable, a path traversal (CWE-22) attack
is possible through lines 2, 4, and 6. In addition, there is no validation that the ftype