...

pen->num_vertices = _cairo_pen_vertices_needed(
  gstate->tolerance, radius, &gstate->ctm
);

if (pen->num_vertices > SIZE_MAX / sizeof(cairo_pen_vertex_t)) {
  /* Handle error condition */
}
pen->vertices = malloc(
  pen->num_vertices * sizeof(cairo_pen_vertex_t)
);

Left-Shift Operator

The left-shift operator takes two operands of integer type. For examples of usage of the left-shift operator, see INT34-C. Do not shift a negative number of bits or more bits than exist in the operand.

Atomic Integers

The C Standard defines arithmetic on atomic integer types as read-modify-write operations with the same representation as nonatomic integer types. As a result, wrapping of atomic unsigned integers is identical to nonatomic unsigned integers and should also be prevented or detected.

...