There is a heap overflow in ATF image packing. The file included in this archive demonstrates the vulnerability.