Code execution via output filename integer overflow

Integer overflow in Ghostscript before 10.04.0 allows local users to traverse paths and execute code through a crafted output filename. The gx_parse_output_format function accumulates decimal width and precision fields without rejecting values above INT_MAX, then uses wrapped length arithmetic that can accept a truncated path. Exploitation requires user interaction and control of the output filename format; successful traversal can place output outside the intended directory and lead to code execution.