Service crash and heap disclosure via PGM conversion

Out-of-bounds read in stb_image 2.27 allows attackers to crash an image-processing service or disclose bounded heap data via a crafted PGM file. The stbi__pnm_load function calls stbi__convert_format instead of stbi__convert_format16 for 16-bit PGM channel conversion, producing a half-sized buffer that stbi__convert_16_to_8 reads past. A consuming application must load a sufficiently large 16-bit PGM while requesting four output channels; the result is a crash or disclosure of up to 1,024 noncontiguous heap bytes without attacker control of the read location.