Integer overflow in clipboard processing functions readClientCutText()/readServerCutText().
vulners.com/securityvulns/securityvulns:doc:13974