Xfig fig2dev 3.2.7a has a stack-based buffer overflow in the calc_arrow function in bound.c.
{ "urgency": "unimportant" }