Descriptionrlottie through 0.2, fixed in commit 2cab35d, contains a denial of service vulnerability that allows remote attackers to abort the calling process by supplying a crafted Lottie animation with a negative or non-finite Polystar point count value. The parser reads the point count into a float without validation, and during rendering the value is converted to size_t via ceilf or floorf causing an integer wraparound near 2^64 that triggers an uncaught std::length_error from std::vector::reserve, which propagates to std::terminate and crashes the process on the first rendered frame.