integer-overflow

A crafted sprite overflows the blitter's heap

Attack-surface analysis of OpenTTD 160beta1: integer overflow in sprite decoding, untrusted savegame and packet parsing, and why EDR stays blind.