[gpu] Fix signed integer overflow in extents computation

Glyph extents from malicious fonts can have extreme values
that overflow when computing x_bearing + width or the
width/height deltas in hb_gpu_paint_encode.  Widen to int64_t
before the arithmetic.

Fixes: https://oss-fuzz.com/testcase-detail/crash-8a9ba2164fd1e6a6fd7a8ed566cf4d0350c1357e

Assisted-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/hb-gpu-paint.cc

diff --git a/src/hb-gpu-paint.cc b/src/hb-gpu-paint.cc
index f83bad8..8bbec06 100644
--- a/src/hb-gpu-paint.cc
+++ b/src/hb-gpu-paint.cc
@@ -166,9 +166,9 @@
   int idx = (int) (c->sub_blobs.length - 1);
 
   int x0 = ext.x_bearing;
-  int x1 = ext.x_bearing + ext.width;
+  int x1 = (int) ((int64_t) ext.x_bearing + ext.width);
   int y0 = ext.y_bearing;
-  int y1 = ext.y_bearing + ext.height;
+  int y1 = (int) ((int64_t) ext.y_bearing + ext.height);
 
   c->clip_stack[c->clip_depth] = {
     HB_CODEPOINT_INVALID, nullptr,
@@ -477,9 +477,9 @@
   /* Accumulate extents: x_bearing/y_bearing are top-left, width
    * positive, height negative (growing down). */
   int x0 = ext.x_bearing;
-  int x1 = ext.x_bearing + ext.width;
+  int x1 = (int) ((int64_t) ext.x_bearing + ext.width);
   int y0 = ext.y_bearing;
-  int y1 = ext.y_bearing + ext.height;
+  int y1 = (int) ((int64_t) ext.y_bearing + ext.height);
   c->ext_min_x = hb_min (c->ext_min_x, hb_min (x0, x1));
   c->ext_max_x = hb_max (c->ext_max_x, hb_max (x0, x1));
   c->ext_min_y = hb_min (c->ext_min_y, hb_min (y0, y1));
@@ -1477,8 +1477,8 @@
   {
     extents->x_bearing = paint->ext_min_x;
     extents->y_bearing = paint->ext_max_y;
-    extents->width     = paint->ext_max_x - paint->ext_min_x;
-    extents->height    = paint->ext_min_y - paint->ext_max_y;
+    extents->width     = (int) ((int64_t) paint->ext_max_x - paint->ext_min_x);
+    extents->height    = (int) ((int64_t) paint->ext_min_y - paint->ext_max_y);
   }
 
   hb_blob_t *recycled = paint->recycled_blob;

test/fuzzing/fonts/clusterfuzz-testcase-minimized-hb-gpu-fuzzer-6490288851058688

diff --git a/test/fuzzing/fonts/clusterfuzz-testcase-minimized-hb-gpu-fuzzer-6490288851058688 b/test/fuzzing/fonts/clusterfuzz-testcase-minimized-hb-gpu-fuzzer-6490288851058688
new file mode 100644
index 0000000..a9af5f1
--- /dev/null
+++ b/test/fuzzing/fonts/clusterfuzz-testcase-minimized-hb-gpu-fuzzer-6490288851058688
Binary files differ