Memory corruption via unchecked replacement-size arithmetic

Integer overflow in stb_dupreplace in Sean Barrett stb f056911 allows remote attackers to corrupt memory via crafted replacement input. stb_dupreplace counts matches in an int and allocates strlen(src) plus count times the unsigned length difference without checking for arithmetic wrap, then copies every replacement into that buffer. Exploitation requires a consuming application to pass attacker-controlled strings to the deprecated header function; successful triggering corrupts that application's process memory.