`U16_FWD_1`

ICU macro U16_FWD_1(s, i, length) that advances index i past one UTF-16 code point, reading s[i] and, if it is a lead surrogate and i != length, also peeking at the next code unit to see whether it is a trail surrogate.

`CaseMappingHarfBuzzBufferFiller`

Blink shaping helper in case_mapping_harfbuzz_buffer_filler.cc that case-maps text (e.g. upper/lower-casing) and fills a HarfBuzz buffer, walking the source text one code point at a time when a character-by-character mapping is needed.

`buffer` / `start_index` / `num_characters`

the full UTF-16 text span, the offset of the run being processed inside it, and the length of that run; the run occupies [start_index, start_index + num_characters) of buffer.

1. Supply text to shape Web content provides text that Blink shapes through CaseMappingHarfBuzzBufferFiller with case mapping applied (which CSS features route text here is not shown in the diff; inferred to be case-transforming styles).
2. Non-zero run offset The text is split so the processed run has start_index > 0, making char_index exceed num_characters and defeating the i != length guard in U16_FWD_1.
3. Lead surrogate at end of buffer The final code unit of buffer is an unpaired lead surrogate, so U16_FWD_1 peeks at buffer[buffer.size()], one UChar past the end of the span.
4. Out-of-bounds read The adjacent heap value is read and influences whether new_char_index is advanced once more; any subsequent effect on buffer.subspan(...) or the case-mapped output is (inferred).

• third_party/blink/renderer/platform/fonts/shaping/case_mapping_harfbuzz_buffer_filler.cc

• ICU iteration macros with relative bounds
  Grep for U16_FWD_1, U16_NEXT, U16_BACK_1, U8_NEXT and similar where the length argument is a run length or count rather than an absolute end index while the index starts at a non-zero offset.
• `UNSAFE_TODO`-wrapped pointer macros
  Prioritize remaining UNSAFE_TODO(...) sites in platform/fonts/shaping/ that pass .data() plus an index into C macros, since span bounds checking does not apply inside them.
• Offset/length confusion in text runs
  Review shaping and case-mapping helpers that take (start_index, num_characters) pairs for places that compare an absolute index against num_characters instead of start_index + num_characters or the buffer size.

Heap OOB read in Blink text shaping

U16_FWD_1(buffer.data(), new_char_index, num_characters);

for (unsigned char_index = start_index;
     char_index < start_index + num_characters;) {
  unsigned new_char_index = char_index;
  U16_FWD_1(buffer.data(), new_char_index, num_characters);
  ...
}