Kimdir01

PNG decoder: a duplicate IHDR chunk after IDAT resizes the image after allocation, causing a heap out-of-bounds write

Binary resource loader: unbounded map_id from a theme file causes a heap out-of-bounds write in the GUIX-allocated arena

JPEG decoder: a duplicate SOF0 after SOS publishes a pixelmap that misreports its own allocation size

JPEG decoder: truncated segments are read past the image buffer, and a zero sampling factor hangs the decode

The GUIX binary resource (theme) loader sizes its arena and populates it in two separate passes that traverse the resource file with independent cursor arithmetic. Because `gx_page_header_data_size` is never validated against the glyph data a page actuall