It's possible to lseek behind file boundary to read arbitrary memory.
vulners.com/securityvulns/securityvulns:doc:10955
vulners.com/securityvulns/securityvulns:doc:11285