Exploiting a single null byte off-by-one error to get code exec.