Avoid integer overflow leading to out-of-bounds write

Thanks to Maddie Stone and Google's Project Zero for discovering this
issue, providing a proof-of-concept, and a great analysis.

Closes: https://gitlab.freedesktop.org/pixman/pixman/-/issues/63