Code execution via wrapped vindex_offset allocation

Integer overflow in GTKWave 3.3.115 allows attackers to execute arbitrary code when a victim opens a crafted VZT file. The vzt_rd_init_smp function multiplies the attacker-controlled numfacs value by four to allocate vindex_offset without checking for 32-bit wraparound, then writes numfacs entries into the undersized heap buffer. Exploitation requires user interaction and a 32-bit build; successful heap corruption can overwrite pointers and redirect writes to attacker-chosen locations.