Local code execution via canvas-size integer overflow

Buffer overflow in caca_resize in Caca Labs libcaca 0.99.beta19 allows local users to execute arbitrary code via crafted canvas data. The resize path multiplies attacker-controlled width and height without checking integer overflow, underallocating canvas storage before an out-of-bounds write. Exploitation requires a local process to pass crafted canvas data to the library; the demonstrated proof of concept crashes under AddressSanitizer, while the published impact is code execution in that process's user context.