[gpu] Fix out-of-bounds read in emit_all_clip_sub_blobs

When clip nesting exceeds HB_GPU_PAINT_MAX_CLIP_DEPTH (3),
push_clip_glyph sets unsupported=true but still increments
clip_depth.  emit_all_clip_sub_blobs then iterated clip_depth
without capping, reading past the fixed-size clip_stack array.

Cap the iteration at HB_GPU_PAINT_MAX_CLIP_DEPTH.

Fixes: https://oss-fuzz.com/testcase-detail/6573156621156352

Assisted-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/hb-gpu-paint.cc

diff --git a/src/hb-gpu-paint.cc b/src/hb-gpu-paint.cc
index 76050cf..f83bad8 100644
--- a/src/hb-gpu-paint.cc
+++ b/src/hb-gpu-paint.cc
@@ -497,7 +497,7 @@
 {
   for (unsigned i = 0; i < HB_GPU_PAINT_MAX_CLIP_DEPTH; i++)
     out[i] = -1;
-  for (unsigned i = 0; i < c->clip_depth; i++)
+  for (unsigned i = 0; i < hb_min (c->clip_depth, (unsigned) HB_GPU_PAINT_MAX_CLIP_DEPTH); i++)
   {
     out[i] = emit_clip_sub_blob (c, c->clip_stack[i]);
     if (out[i] < 0)

test/fuzzing/fonts/clusterfuzz-testcase-minimized-hb-gpu-fuzzer-6573156621156352

diff --git a/test/fuzzing/fonts/clusterfuzz-testcase-minimized-hb-gpu-fuzzer-6573156621156352 b/test/fuzzing/fonts/clusterfuzz-testcase-minimized-hb-gpu-fuzzer-6573156621156352
new file mode 100644
index 0000000..980c5e2
--- /dev/null
+++ b/test/fuzzing/fonts/clusterfuzz-testcase-minimized-hb-gpu-fuzzer-6573156621156352
Binary files differ