CVE-2014-9670

Multiple integer signedness errors in the pcf_get_encodings function in
pcf/pcfread.c in FreeType before 2.5.4 allow remote attackers to cause a
denial of service (integer overflow, NULL pointer dereference, and
application crash) via a crafted PCF file that specifies negative values
for the first column and first row.

Bugs

• <https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=777656&gt;
• <http://code.google.com/p/google-security-research/issues/detail?id=158&gt;
• <http://savannah.nongnu.org/bugs/?43548&gt;