--- freetype-2.3.11/src/winfonts/winfnt.c 2009-07-31 18:45:19.000000000 +0200 +++ freetype-2.3.11/src/winfonts/winfnt.c 2012-03-28 11:57:05.000000000 +0200 @@ -4,7 +4,7 @@ /* */ /* FreeType font driver for Windows FNT/FON files */ /* */ -/* Copyright 1996-2001, 2002, 2003, 2004, 2006, 2007, 2008, 2009 by */ +/* Copyright 1996-2004, 2006-2012 by */ /* David Turner, Robert Wilhelm, and Werner Lemberg. */ /* Copyright 2003 Huw D M Davies for Codeweavers */ /* Copyright 2007 Dmitry Timoshkov for Codeweavers */ @@ -825,7 +825,14 @@ root->charmap = root->charmaps[0]; } - /* setup remaining flags */ + /* set up remaining flags */ + + if ( font->header.last_char < font->header.first_char ) + { + FT_TRACE2(( "invalid number of glyphs\n" )); + error = FNT_Err_Invalid_File_Format; + goto Fail; + } /* reserve one slot for the .notdef glyph at index 0 */ root->num_glyphs = font->header.last_char -