Angelystor

A heap overwrite occurs in the `sail codec load frame v8 xbm()` function within `src/sail-codecs/xbm/xbm.c` when processing X10 static short files. The issue arises because the decoded pixel buffer is allocated using the X11 one-byte-per-literal layout, but the decode loop writes two bytes per literal. When `ceil(width/8)` results in an odd row stride, the X10 literal count includes a padding byte for every row that the destination buffer cannot accommodate. This leads to a forward heap overwrite that scales with the image height when loading XBM files via `sail load from file`, `sail load from memory`, or `sail start loading *`. This can result in process state corruption, crashes, or potential code execution.

An issue exists where webhook destinations are validated only during registration and not during use. The `NoInternalUrlRule` function in `backend/app/Validators/Rules/NoInternalUrlRule.php` uses `gethostbyname()` to reject private and reserved IP ranges, but public hostnames are permitted. During dispatch, the `WebhookDispatchService` utilizes the stored URL via `spatie/laravel-webhook-server` without re-validating the destination. Because `backend/config/webhook-server.php` does not configure Guzzle options, redirect following is enabled by default. This allows a destination to redirect the server to a loopback, private, or cloud metadata address, or allows an attacker to change a DNS record after registration to achieve the same result. The `WebhookResponseHandlerService` stores the response body in the webhook log, which is then exposed via the `WebhookLogResource` endpoint, allowing the requester to read responses from internal services. This affects both event and organizer webhooks.