AIKIDO-2026-842584

TL;DR

harfrust performs OpenType GPOS positioning and propagates mark and cursive attachment offsets across glyphs while shaping text. When it shapes an overly long grapheme cluster, such as a base character followed by tens of thousands of combining marks, the accumulated signed 32-bit attachment offsets exceed their range. The unchecked additions and subtractions overflow and trigger an arithmetic overflow panic that aborts shaping. The fix replaces the offset arithmetic with saturating operations so the values clamp instead of overflowing.