The transpose crate before 0.2.3 for Rust allows an integer overflow via inputwidth and inputheight arguments.
{ "urgency": "not yet assigned" }