Process-memory disclosure via overflowed tile counts

Out-of-bounds read in stb through commit f056911 allows remote attackers to read process memory through a crafted tileset image. stbhw_build_tileset_from_image derives h_count and v_count from image header fields, multiplies them as signed integers, and uses the results to allocate pointer arrays before filling those arrays, so overflow can under-allocate storage and drive out-of-bounds access. Exposure requires a host application to compile stb_herringbone_wang_tile.h and pass an attacker-controlled tileset image to the affected API; the bounded consequences are adjacent-process-memory disclosure or a crash.