In sam2p 0.49.4, there are integer overflows (with resultant heap-based buffer overflows) in input-bmp.ci in the function ReadImage, because "width * height" multiplications occur unsafely.
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-16663.json"