Source: imlib2 Version: 1.4.8-1 loader_xpm.c contains the following code:
sscanf(line, "%i %i %i %i", &w, &h, &ncolors, &cpp);
if ((ncolors > 32766) || (ncolors < 1))
...
This doesn't check return value from sscanf(), so for some invalid XMP files
(such as the attached one), the ncolors variable will remain uninitialized.
Found using american fuzzy lop: http://lcamtuf.coredump.cx/afl/ -- Jakub Wilk
