matio (aka MAT File I/O Library) 1.5.18 up to and including 1.5.21 has a heap-based buffer overflow in ReadInt32DataDouble (called from ReadInt32Data and Mat_VarRead4).
matio project matio