Attacker-controlled input can lead to an out-of-bounds index, which causes buffered-reader to panic. This has been fixed in versions 1.2.0, 1.1.5, and 1.0.2 of buffered-reader.