Code execution via stale token-buffer pointer

Use-after-free in GTKWave 3.3.115 allows attackers to execute arbitrary code when a crafted VCD file is processed by vcd2lxt. The get_vartoken function retains varsplit as a pointer into yytext across realloc, then writes through that stale pointer and derives an attacker-controlled length that can under-size a later strcpy destination. Exploitation requires a user to run the vcd2lxt conversion utility on the malicious file, enabling code execution in that user’s context.