In libpixman in Pixman before 0.42.2, there is an out-of-bounds write (aka heap-based buffer overflow) in rasterize edges 8 due to an integer overflow in pixman sample floor y.