Toorto

The issue is a heap-based buffer over-read in the `DCTStream::readScan()` function, located at `Stream.cc`. This can be triggered by sending a crafted PDF document to the `pdftops` tool, potentially allowing an attacker to cause Information Disclosure.

The issue is a heap-based buffer overflow in the `fz append display node` function, located at `fitz/list-device.c`, which allows remote attackers to execute arbitrary code via a crafted PDF file. This occurs when a large BDC property name overflows the allocated size of a display list node.