Thanks for auditing coreutils!
A bug in sort would have been a surprise, and more of an issue,
so I've looked at it first.
Rich Burridge wrote:
...
Error: Null pointer dereference (CWE 476)
Read from null pointer 's'
at line 3389 of components/coreutils/coreutils-8.5/src/sort.c in
function 'main'.
Function 'parse_field_count' may return constant 'NULL' at line
3130, called at line 3387.
That is not true when the third argument to parse_field_count is
non-NULL, as is the case in sort.c from coreutils-8.5 (and in the
latest from git). In that case, parse_field_count exits upon failure
and cannot return NULL.