Memory corruption via incorrect sampling-coordinate saturation check

Heap-based buffer overflow in Pixman before 0.42.2 allows remote attackers to corrupt memory through crafted graphics input. The pixman_sample_floor_y helper compares a fixed-point coordinate against 0x8000 instead of its signed 0xffff8000 value, so saturation fails before rasterize_edges_8 performs a heap write. Reachability requires an application to render attacker-controlled graphics data after user interaction; the out-of-bounds write corrupts that application's heap memory.