    write(buf) {
      if (this.buffer === null) {
        this.buffer = buf;
      } else {
        this.buffer = Buffer.concat([this.buffer, buf],
                                    this.buffer.length + buf.length);
      }
      // Wait for at least all length bytes
      if (this.buffer.length < 4)
        return;

      const len = readUInt32BE(this.buffer, 0);
      // Make sure we have a full message before querying pageant
      if ((this.buffer.length - 4) < len)
        return;

      buf = this.buffer.slice(0, 4 + len);
      if (this.buffer.length > (4 + len))
        this.buffer = this.buffer.slice(4 + len);
      else
        this.buffer = null;

      let hadError = false;
      const proc = this.proc = spawn(EXEPATH, [ buf.length ]);
      proc.stdout.on('data', (data) => {
        this.emit('data', data);
      });
      proc.once('error', (err) => {
        if (!hadError) {
          hadError = true;
          this.emit('error', err);
        }
      });
      proc.once('close', (code) => {
        this.proc = undefined;
        let err;
        if (!hadError && (err = ERROR[code])) {
          hadError = true;
          this.emit('error', err);
        }
        this.emit('close', hadError);
      });
      proc.stdin.end(buf);
    }
The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.