Out-of-bounds writes via integer-overflowed grid allocation

Heap buffer overflow in jxl-grid before 0.6.2 and jxl-oxide before 0.12.6 allows attackers to corrupt memory via crafted JPEG XL images. AlignedGrid::with_alloc_tracker multiplies width by height and related grid arithmetic derives offsets without checked overflow, so oversized frame, canvas, or ROI dimensions can allocate backing storage smaller than the logical grid. Exposure requires a 32-bit build and attacker-controlled image decoding through render_frame or similar paths; later mutable subgrid and raw-pointer writes can crash the process or potentially execute code.