Heap out-of-bounds read via undersized input buffer

Heap-based buffer overflow in Little CMS lcms2 2.16 allows attackers to read beyond a heap buffer during a color transformation. UnrollChunkyBytes in cmspack.c reads nChan input bytes without receiving or validating the input buffer length, so an undersized caller-supplied buffer is read past its allocation. The supplier disputes that lcms2 is vulnerable because the reproducer's third-party harness allocates too little memory before calling the library; the demonstrated consequence is an AddressSanitizer abort, not a production exploit.