Index: pango-impl-utils.h
===================================================================
--- pango-impl-utils.h	(revision 2519)
+++ pango-impl-utils.h	(working copy)
@@ -28,6 +28,8 @@
 
 G_BEGIN_DECLS
 
+/* Some type definition macros */
+
 #define PANGO_DEFINE_TYPE_FULL(name, prefix,				   \
 			       class_init, instance_init,		   \
 			       parent_type, abstract)			   \
@@ -75,11 +77,40 @@ prefix ## _get_type (void)				          
 			 parent_type, G_TYPE_FLAG_ABSTRACT)
 
 
+
 /* String interning for static strings */
 #define I_(string) g_intern_static_string (string)
 
 
+
+/* Overflow-safe arithmetic */
+
+static inline int
+int_add (int a, int b)
+{
+  int c = a + b;
+
+  if (G_UNLIKELY ((a < 0) == (b < 0) && (a < 0) != (c < 0)))
+    c = (a < 0) ? G_MININT : G_MAXINT;
+
+  return c;
+}
+
+static inline int
+int_sub (int a, int b)
+{
+  int c = a - b;
+
+  if (G_UNLIKELY ((a < 0) != (b < 0) && (a < 0) != (c < 0)))
+    c = (a < 0) ? G_MININT : G_MAXINT;
+
+  return c;
+}
+
+
+
 /* Some functions for handling PANGO_ATTR_SHAPE */
+
 void _pango_shape_shape (const char       *text,
 			 gint              n_chars,
 			 PangoRectangle   *shape_ink,
Index: glyphstring.c
===================================================================
--- glyphstring.c	(revision 2517)
+++ glyphstring.c	(working copy)
@@ -209,18 +209,18 @@ pango_glyph_string_extents_range (PangoG
 	{
 	  if (ink_rect->width == 0 || ink_rect->height == 0)
 	    {
-	      ink_rect->x = x_pos + glyph_ink.x + geometry->x_offset;
+	      ink_rect->x = int_add (x_pos, int_add (glyph_ink.x, geometry->x_offset));
 	      ink_rect->width = glyph_ink.width;
-	      ink_rect->y = glyph_ink.y + geometry->y_offset;
+	      ink_rect->y = int_add (glyph_ink.y, geometry->y_offset);
 	      ink_rect->height = glyph_ink.height;
 	    }
 	  else
 	    {
 	      int new_x, new_y;
 
-	      new_x = MIN (ink_rect->x, x_pos + glyph_ink.x + geometry->x_offset);
-	      ink_rect->width = MAX (ink_rect->x + ink_rect->width,
-				     x_pos + glyph_ink.x + glyph_ink.width + geometry->x_offset) - new_x;
+	      new_x = MIN (ink_rect->x, int_add (x_pos, glyph_ink.x + geometry->x_offset));
+	      ink_rect->width = int_sub (MAX (int_add (ink_rect->x, ink_rect->width),
+					      int_add (x_pos, int_add (glyph_ink.x + glyph_ink.width, geometry->x_offset))), - new_x);
 	      ink_rect->x = new_x;
 
 	      new_y = MIN (ink_rect->y, glyph_ink.y + geometry->y_offset);
Index: pango-layout.c
===================================================================
--- pango-layout.c	(revision 2519)
+++ pango-layout.c	(working copy)
@@ -2206,9 +2206,9 @@ get_x_offset (PangoLayout     *layout,
 
   /* Alignment */
   if (alignment == PANGO_ALIGN_RIGHT)
-    *x_offset = layout_width - line_width;
+    *x_offset = int_sub (layout_width, line_width);
   else if (alignment == PANGO_ALIGN_CENTER)
-    *x_offset = (layout_width - line_width) / 2;
+    *x_offset = int_sub (layout_width, line_width) / 2;
   else
     *x_offset = 0;
 
@@ -2269,19 +2269,19 @@ get_line_extents_layout_coords (PangoLay
   if (line_ink_layout)
     {
       *line_ink_layout = line_ink;
-      line_ink_layout->x = line_ink.x + x_offset;
-      line_ink_layout->y = y_offset - line_logical.y + line_ink.y;
+      line_ink_layout->x = int_add (line_ink.x, x_offset);
+      line_ink_layout->y = int_sub (y_offset, int_sub (line_logical.y, line_ink.y));
     }
 
   if (line_logical_layout)
     {
       *line_logical_layout = line_logical;
-      line_logical_layout->x = line_logical.x + x_offset;
+      line_logical_layout->x = int_add (line_logical.x, x_offset);
       line_logical_layout->y = y_offset;
     }
 
   if (baseline)
-    *baseline = y_offset - line_logical.y;
+    *baseline = int_sub (y_offset, line_logical.y);
 }
 
 /* if non-NULL line_extents returns a list of line extents
@@ -2400,15 +2400,15 @@ pango_layout_get_extents_internal (Pango
 	  else
 	    {
 	      new_pos = MIN (ink_rect->x, line_ink_layout.x);
-	      ink_rect->width =
-		MAX (ink_rect->x + ink_rect->width,
-		     line_ink_layout.x + line_ink_layout.width) - new_pos;
+	      ink_rect->width = int_sub (
+		MAX (int_add (ink_rect->x, ink_rect->width),
+		     int_add (line_ink_layout.x, line_ink_layout.width)), new_pos);
 	      ink_rect->x = new_pos;
 
 	      new_pos = MIN (ink_rect->y, line_ink_layout.y);
-	      ink_rect->height =
-		MAX (ink_rect->y + ink_rect->height,
-		     line_ink_layout.y + line_ink_layout.height) - new_pos;
+	      ink_rect->height = int_sub (
+		MAX (int_add (ink_rect->y, ink_rect->height),
+		     int_add (line_ink_layout.y, line_ink_layout.height)), new_pos);
 	      ink_rect->y = new_pos;
 	    }
 	}
@@ -2435,22 +2435,22 @@ pango_layout_get_extents_internal (Pango
 	      else
 		{
 		  new_pos = MIN (logical_rect->x, line_logical_layout.x);
-		  logical_rect->width =
-		    MAX (logical_rect->x + logical_rect->width,
-			 line_logical_layout.x + line_logical_layout.width) - new_pos;
+		  logical_rect->width = int_sub (
+		    MAX (int_add (logical_rect->x, logical_rect->width),
+			 int_add (line_logical_layout.x, line_logical_layout.width)), new_pos);
 		  logical_rect->x = new_pos;
 
 		}
 	    }
 
-	  logical_rect->height += line_logical_layout.height;
+	  logical_rect->height = int_add (logical_rect->height, line_logical_layout.height);
 
 	  /* No space after the last line, of course. */
 	  if (line_list->next != NULL)
-	    logical_rect->height += layout->spacing;
+	    logical_rect->height = int_add (logical_rect->height, layout->spacing);
 	}
 
-      y_offset += line_logical_layout.height + layout->spacing;
+      y_offset = int_add (y_offset, int_add (line_logical_layout.height, layout->spacing));
       line_list = line_list->next;
     }
 
@@ -4235,7 +4235,7 @@ pango_layout_run_get_extents (PangoLayou
        * that into ink_rect.
        */
       new_pos = MIN (run_ink->x, run_logical->x);
-      run_ink->width = MAX (run_ink->x + run_ink->width, run_logical->x + run_logical->width) - new_pos;
+      run_ink->width = int_sub (MAX (int_add (run_ink->x, run_ink->width), int_add (run_logical->x, run_logical->width)), new_pos);
       run_ink->x = new_pos;
 
       /* We should better handle the case of height==0 in the following cases.
@@ -4387,36 +4387,36 @@ pango_layout_line_get_extents (PangoLayo
 	  if (ink_rect->width == 0 || ink_rect->height == 0)
 	    {
 	      *ink_rect = run_ink;
-	      ink_rect->x += x_pos;
+	      ink_rect->x = int_add (ink_rect->x, x_pos);
 	    }
 	  else if (run_ink.width != 0 && run_ink.height != 0)
 	    {
-	      new_pos = MIN (ink_rect->x, x_pos + run_ink.x);
-	      ink_rect->width = MAX (ink_rect->x + ink_rect->width,
-				     x_pos + run_ink.x + run_ink.width) - new_pos;
+	      new_pos = MIN (ink_rect->x, int_add (x_pos, run_ink.x));
+	      ink_rect->width = int_sub (MAX (int_add (ink_rect->x, ink_rect->width),
+					      int_add (x_pos, int_add (run_ink.x, run_ink.width))), new_pos);
 	      ink_rect->x = new_pos;
 
 	      new_pos = MIN (ink_rect->y, run_ink.y);
-	      ink_rect->height = MAX (ink_rect->y + ink_rect->height,
-				      run_ink.y + run_ink.height) - new_pos;
+	      ink_rect->height = int_sub (MAX (int_add (ink_rect->y, ink_rect->height),
+					       int_add (run_ink.y, run_ink.height)), new_pos);
 	      ink_rect->y = new_pos;
 	    }
 	}
 
       if (logical_rect)
 	{
-	  new_pos = MIN (logical_rect->x, x_pos + run_logical.x);
-	  logical_rect->width = MAX (logical_rect->x + logical_rect->width,
-				     x_pos + run_logical.x + run_logical.width) - new_pos;
+	  new_pos = MIN (logical_rect->x, int_add (x_pos, run_logical.x));
+	  logical_rect->width = int_sub (MAX (int_add (logical_rect->x, logical_rect->width),
+					      int_add (x_pos, int_add (run_logical.x, run_logical.width))), new_pos);
 	  logical_rect->x = new_pos;
 
 	  new_pos = MIN (logical_rect->y, run_logical.y);
-	  logical_rect->height = MAX (logical_rect->y + logical_rect->height,
-				      run_logical.y + run_logical.height) - new_pos;
+	  logical_rect->height = int_sub (MAX (int_add (logical_rect->y, logical_rect->height),
+					       int_add (run_logical.y, run_logical.height)), new_pos);
 	  logical_rect->y = new_pos;
 	}
 
-     x_pos += run_logical.width;
+     x_pos = int_add (x_pos, run_logical.width);
      tmp_list = tmp_list->next;
     }
 
