Code execution via wrapped LXT2 block allocation

Integer overflow in GTKWave 3.3.115 allows context-dependent attackers to execute code through a crafted LXT2 waveform file. In lxt2_rd_iter_blocks, the parser doubles the attacker-controlled 32-bit clen value into zlen; 0x80000000 wraps the allocation size to zero, yet fread copies clen bytes into the resulting one-byte zbuff buffer. Opening the malicious file is required, and the resulting controlled out-of-bounds heap write permits code execution with the victim process's privileges.