Integer overflow leading to an out-of-bounds read in basis_universal KTX2 parsing

Attacker-controlled 64-bit KTX2 level offset and length fields were validated using offset + length > data_size. The addition could wrap, allowing an out-of-range level pointer to reach Zstd decompression and the block transcoder. The same overflow pattern affected the supercompression-global-data range.

Richard Geldreich acknowledged the coordinated-disclosure report and fixed both ranges with subtraction-based checks in 3454230543d5. Independent verification confirmed that the 184-byte PoC is rejected cleanly, both disclosed PoCs are ASan/UBSan-clean, and all 33 valid KTX2 regression seeds pass. The fix is on master, newer than v2_10_final_snapshot. The maintainer acknowledged the report and pushed the fix publicly the same day.