CVE-2007-4580
Buffer underflow from a small size value with a large buffer (length parameter inconsistency, CWE-130)
CVE-2007-4268
Chain: integer signedness error (CWE-195) passes signed comparison, leading to heap overflow (CWE-122)