It's either multiply by shifted one or remove upscaling. I am not sure if upscaling is even necessary.

The ImageMagick project is using https://github.com/google/oss-fuzz to find bugs in our own library and in libraries that we use. The fuzzer found an issue and we think this is an issue that should be resolved in the library that we use. This issue is posted under the url https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9999. Below are the details of the issue that can be reproduced using the following technique: https://github.com/google/oss-fuzz/blob/master/docs/reproducing.md.

Stacktrace:

/src/freetype2/src/base/ftbbox.c:297:10: runtime error: left shift of negative value -372
  #0 0xcf1771 in cubic_peak /src/freetype2/src/base/ftbbox.c:297:10
  #1 0xcf0f29 in BBox_Cubic_Check /src/freetype2/src/base/ftbbox.c:374:15
  #2 0xcf0d2a in BBox_Cubic_To /src/freetype2/src/base/ftbbox.c:435:7
  #3 0xce6629 in FT_Outline_Decompose /src/freetype2/src/base/ftoutln.c:249:23
  #4 0xcf0856 in FT_Outline_Get_BBox /src/freetype2/src/base/ftbbox.c:518:15
  #5 0x51b27d in RenderFreetype imagemagick/MagickCore/annotate.c:1589:15
  #6 0x518e11 in GetTypeMetrics imagemagick/MagickCore/annotate.c:873:10
  #7 0x586610 in RenderMVGContent imagemagick/MagickCore/draw.c:4294:17
  #8 0x7d63a2 in ReadTTFImage imagemagick/coders/ttf.c:289:10
  #9 0x5632b1 in ReadImage imagemagick/MagickCore/constitute.c:547:15
  #10 0x7e688d in ExtractPostscript imagemagick/coders/wpg.c:849:10
  #11 0x7e5574 in ReadWPGImage imagemagick/coders/wpg.c:1553:25
  #12 0x5632b1 in ReadImage imagemagick/MagickCore/constitute.c:547:15
  #13 0x6a543b in ReadStream imagemagick/MagickCore/stream.c:1043:9
  #14 0x52ab64 in PingBlob imagemagick/MagickCore/blob.c:3607:13
  #15 0x4a200f in Magick::Image::ping(Magick::Blob const&) imagemagick/Magick++/lib/Image.cpp:3860:12
  #16 0x42b75f in LLVMFuzzerTestOneInput imagemagick/Magick++/fuzz/ping_fuzzer.cc:43:11
  #17 0x4464ae in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/libfuzzer/FuzzerLoop.cpp:553:15
  #18 0x42c702 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/libfuzzer/FuzzerDriver.cpp:292:6
  #19 0x43083e in fuzzer::FuzzerDriver(int*, char***, int ()(unsigned char const, unsigned long)) /src/libfuzzer/FuzzerDriver.cpp:775:9
  #20 0x42c46a in main /src/libfuzzer/FuzzerMain.cpp:19:10
  #21 0x7fa86de7382f in __libc_start_main /build/glibc-LK5gWL/glibc-2.23/csu/libc-start.c:291
  #22 0x40a2d8 in _start

Links: https://git.savannah.gnu.org/cgit/freetype/freetype2.git/tree/src/base/ftbbox.c?id=05439f5cc69eaa3deaf3db52a7999af09a2c293a#n297

Commit: 05439f5cc69eaa3deaf3db52a7999af09a2c293a