Out-of-bounds read and write via scanline overflow

Integer overflow in VipsForeignLoadTiff in libvips before 8.18.3 allows attackers to read or write image data via a crafted TIFF. The TIFF loader can accept a many-band image whose scanline size evades validation, and vips_image_sanity in libvips/iofuncs/image.c does not reject scanlines that exceed INT_MAX, so later buffer-region arithmetic uses attacker-controlled negative mmap offsets. Exploitation requires feeding an untrusted TIFF to a libvips-based process; observed consequences are disclosure or corruption of other image buffers and likely process crashes, while public sources have not demonstrated code execution.