Will Drewry reported an integer overflow flaw in pango's pango_glyph_string_set_size in pango/glyphstring.c:

 61   while (new_len > string->space)
 62     {
 63       if (string->space == 0)
 64         string->space = 1;
 65       else
 66         string->space *= 2;
 67 
 68       if (string->space < 0)
 69         {
 70           g_warning ("glyph string length overflows maximum integer size, truncated");
 71           new_len = string->space = G_MAXINT - 8;
 72         }
 73     }
 74 
 75   string->glyphs = g_realloc (string->glyphs, string->space * sizeof (PangoGlyphInfo));

string->space is checked against overflow when doubling it, but is not protected against overflow when multiplied by sizeof(PangoGlyphInfo).

Upstream fix:
http://github.com/bratsche/pango/commit/4de30e5500eaeb49f4bf0b7a07f718e149a2ed5e

Acknowledgements:

Red Hat would like to thank Will Drewry for reporting this issue.