raster Rust crate CVE-2026-71202

The raster crate (CPE: cpe:2.3:a:kosinix:raster:*:*:*:*:*:*:*:*) is a Rust image-processing library authored by kosinix. The flaw lives in src/editor.rs inside the crop() function, which clamps the requested crop width and height against source dimensions but applies no upper-bound check to offset_x or offset_y - only a lower-bound clamp against zero. When an attacker supplies an offset beyond the image edge, the subtraction width2 - offset_x (performed as signed i32) wraps in Rust release builds (release mode uses wrapping two's-complement arithmetic rather than the overflow panic of debug mode), producing a large negative integer. That value is subsequently cast to usize - a widening reinterpretation that yields an astronomically large allocation size - and forwarded to Vec::with_capacity() inside Image::blank(). The allocator rejects the impossible capacity, Rust panics, and the OS terminates the process. CWE-191 (Integer Underflow / Wrap-or-Wraparound) precisely describes this root cause: an arithmetic operation produces a result below the minimum representable value of the type, and the wraparound is later interpreted in a type context where it causes catastrophic downstream behaviour.