In the following change + if ( FT_QNEW_ARRAY( outline.points, limit + 4 ) || + FT_QNEW_ARRAY( outline.tags, limit ) || + FT_QNEW_ARRAY( outline.contours, limit ) || + FT_QNEW_ARRAY( unrounded, limit + 4 ) )
The out of bounds write requires a short integer overflow with a limit value of 0xFFFD - 0xFFFF. In the patch when we change the second call to FT_QNEW_ARRAY to remove the addition of +4 the size value is now negative and the call to FT_QNEW_ARRAY call will fail with an error code causing the logic to short circuit and prevent the out of bounds write from occurring. While limit is still signed the security risk is mitigated by the early exit condition. If we also want to make the limit variable unsigned, we can additionally patch based off the following FreeType commit: https://gitlab.freedesktop.org/freetype/freetype/-/commit/73720c7c9958e87b3d134a7574d1720ad2d24442
