Heap-based buffer overflow in main.c of slocate 2.6 and possibly other versions may allow local users to gain privileges via a modified slocate database that causes a negative \pathlen\ value to be used.