read_colordef in read.c in Xfig fig2dev 3.2.7b has an out-of-bounds write. make_arrow in arrow.c in Xfig fig2dev 3.2.7b allows a segmentation fault and out-of-bounds write because of an integer overflow via a large arrow type