A buffer overflow flaw was reported in autotrace's input_bmp_reader() function.  When autotrace is compiled with FORTIFY_SOURCE, this is caught and turned into a simple denial of service.  As reported:

In input-bmp.c, the input_bmp_reader() function creates a buffer on the 
stack:

91 unsigned char buffer[64];

Later on

169 else if (Bitmap_File_Head.biSize <= 64) /* Probably OS/2 2.x */
170 {
171 if (!ReadOK (fd, buffer, Bitmap_File_Head.biSize - 4))

We control Bitmap_File_Head.biSize. A value of 0 meets the <=64 
requirements, and 0 - 4 should result in almost 4294967295 bytes being 
read into the buffer.