Created attachment 44288 [details] [review]
Quick fix which solves the heap corruption.
Due to an interleaved grow(realloc) operation the heap can get corrupted.
I attached a "quick fix" which solves the problem.
Thanks for the bug report. I have committed a different fix that avoids directly accessing cairo_array_t private data.