An integer overflow in the computation of max_glyph_size lets bounds.width * bounds.height wrap to a small allocation size.

67d58696-a104-48a1-9e17-4716b0abb75d