A flaw was found in Dia's Network Bus object loader. When opening a crafted Dia project (.dia) file, the bus_handles attribute supplies num_handles without validation. Later, when a bus handle is moved, bus_handle_moved() allocates two arrays on the stack using g_alloca() sized by num_handles, which can exhaust the thread stack and cause memory corruption, application crash, or potentially arbitrary code execution. The same g_alloca pattern exists in objects/Misc/tree.c.