heap OOB write in convert file from to() via a crafted Content-Type header allows attacker to OOB write when email is used as a template.