Arbitrary code execution via stale varsplit pointer

Use-after-free in GTKWave 3.3.115 vcd2lxt2 allows context-dependent attackers to execute code through a crafted VCD file. The get_vartoken function retains varsplit into yytext across realloc; if the buffer moves, later length calculation and copying use freed memory and can overflow the heap. Exploitation requires a victim to open or convert the malicious file, and successful corruption runs code in that victim's process.